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ABSTRACT 



A mecbod of mam^ging ihe ptocessiaQ of in£6rxDation using 
a ficst neural network, tbc tnfoczaatioo relating to the trans- 
micron of messages in a tclcconinnmications network, uses 
the steps of: 

(0 awmtoring the perfonuance ol the Qisi neural Twtwodc 
in processing the information; 

(ii) creating a secood neural network of the sane topology 
as the first when a predetermined performance thresh- 
old is reached, and 

(iii) letraimoe the second neural network while oontimi- 
ing to process the infonnation uscng the fiist neural 
nciwcork. if the neural networks arc imf^emented usi^g 
cbjectfi, fiucfa retraiatng can be fadHtatad by using a 
pers]!vtaDce mechanic to cnabte the objects to be 

Stored and moved, .^plicatioos in fraud detection. 
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^HtLi vyui^r^ moiliod3 of dolecdce twS are often bas6d on simple 

FIELD OF THE INVENnONf strstcgies which can easily be defeated by dcvw thieves 

^ c .^-^^ rh. . 5 who realise what fraid-detectioD tedmiqws arc being used 

this invcmion icUies to methods of maragmg the pro- 

c^of iiJcrmaiionusinijaDe^^^^ ^ ^^^^ b^,^ developed, 

processing mfonoaiioii «>laung to the utuasmission of . "t^ . ^-ri^ u is now being 

messagps. to methods of deriving output d-u fmm^ STudS 5^ea<S^^^^^ 

matioD about the liansmisvion of tncssagea. and to qotz^ ^^^^^^i behavlS and tl»i5 a simple set of rules 

^ndi.g^ems,«ndto^^^ ^^^SZ^ZS^^ 

able form for such methods ^ systems. ^tSTXbascd^tems to all^ each eufiiomcr to have 

BACKGROUND OF THE INVEOTION their own unique thresholds in not possible due to the sheer 

sicuadons in which largp amounts of time-variant data are namelyi , ^ t. * »«>.^-™.^ ^ni 

available For exaropte, detection of lelccomnnmicalioos Ftand is dynwpjc by natuie; tondnkm beh«>wir wai 

fraud, detection of credit uatd fraud, encrypUon key man- change over time. 

agemcm systems and carl]'' problem identification. The size of the problem area is vast, due to the num^ ot 

Oofi vtdb)cm is that kno^ anomaly detectois and mctb- users on a octwork, and the mmibcr of calls made, 

ods of anonwly deudloa are designed for used with only Rapid identification of &aud is needed; tosses from a 

one sudi situation. They cannot ea&ly be used in otb« gfveo case of fraud tend to grow cxpoDCDtally. 

situations. Each anomaly deteciiOL sitaation involves a of frwid a« paiticularly cosUy and should 

specific type of data and specific sources and fonnaUfor thai ^ therelore be the subject of special attention e.g. intcr- 

daia. An anomaly detector designed for one simation wodcs national phone caHa 

spcdficaUy for a certain type, source and fiwmat of data and Customer transparency; a customer shouW not sec the 

it is difficult to adapt the anomaly detector for use in another detection system in acdon. 

situation. Koown methods of adapting 8» anomaly detector AflOiher method of detecting telecommumcations fraud 
for used in a new sicuatiwa have involved carryius ^ 30 involves using neural network technology. One problem 

adaptation mairuaUy. TTiis is a lengthy ard expensive cask ^ neural aetwcnks to detect anomalies in a data 

requiring specialist knowj.edge not only of the technology ^ pre-processing the information to input to the 

invoked in the anomaly detector but also of the appKcatioa jjcural network. The input information needs to be rcpre- 

(jpmains invob^ed. The risk of ctrors being made is also seated in a way which captures the essential features of the 
b^. 35 informaiion and emphasises these in a manner suitable for 

Another problem is thai a particular method of anomaly use by the neural network itself. TTje neural network iiecds 

detection is oft&sx most suitable for one particular sitoation- to detect fraud efficicndy without wasting time mainlaming 

This means thai iransfisr cf a paiticular anomaly detector 10 processing redundant information or simply detecting 

a new simalion may not bo appropriate unless core elemcois -noise" in the data. Al the same lime the neural nchworic 

of the anomaly detector method and/or apparatus are ^ ^eeds enough infiorraation to be able to detect many differem 

adapted. This is particulai ly time conswming and cjqjeusivc ^ypcs of fraud inchiding types of fraud which may evolw m 

particularly as the dcvclopmem of a new anomaly detector ^ture. As wen as this the neural network shcmld be 

from sc*accb may often he necessary. pi^idcd with information in away that it is able to allow for 

One application for aoomaly deteaion is the^ detection of legitimate changes in behaviour and not identify these as 

tejecommuoicalions fraud. Telecommunications fraud is a 45 potential featids, * j ♦ ^- 

multi-biHion doHar problem aioiind the world. Anticipated a particular problem for any known method or delccuiig 

losses ar& in excess of SI hillioo a year in the mobile market fraud is that both static classiflcatian and temporal ptoOiP- 

akine. For cjcample. the Cellular Telecoms Industry Asso- tion are rcQuiicd. Unat is, anomalous use has to be 

dation estimate dial in 1996 the cost to US carriers of as such, but only iuceUtwntn an emetgmg temporal pattern, 

mobile thono fraud alone is $1.6 million per day, projected 50 Over a period of time an individual phone wiU e^neraie a 

ro rise to S2.5 million per day by IW. TTiis makes tele- macroscopic pattern of use, m which, for example, mtcr- 

ohone fraud an expensive operating cost for every telephone continental calls may be rare; however withm this oycrau 

^rvioe provider iotite iworld. Because the telecommunica. pattern there wiU ii»vitably be violaiion&-Hon a particul^ 

tions market ie e>cpandii^5 rupidly the problem of telephone day ihe phone n«y "^^^^^'^T!^;^*^^^^ 

fraud is set to become larger. 55 A pattern of behaviour may only be aoomatous leUtive to 

Mbfit telephone opcnUars have some defence agaitKt the historical pattern of behaviour. 

fr^alS^ placcTb^are risk limitation tools such as Another problem is that a part^ctUartyp^^^^^ 

Smlc^gation of call^attempls, credit checking and be analysed by a aeura^ nclwodc is often j^ iy^'Tlu 

^ toSSS^nin&or mmbZT fo«naxs. For example, information ^^f^^^^^ '^JT 

fmid^er^ to the^wodc by emulating or 60 phone calls is typically contamcd m ^^.^7«>^^^ 

^S^ idScatinn code of a genuine iilephone. This cootcm and foanat of call 

3te^hi a multiple cccurrcDce of the telephone unit. t^ecommuuicarious systems and m 

SlinscU^ Xr^ihcftaudster emulate; or copies the such Information 10 be mput di«Ctly to a oeuial netwodc 

identification codes of several diferent gemxine telephone ^^^^^'^^^^^ ^ i^^,Hon has been 
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acural network system is being used to detect fraudsters 
much informjtign aborui the bchaviorur of cusiomcre is 
prepared for mpMt to the system. This infonnation cofuld also 
be used fci maikctins purposes to develop a muidi more 
detailed vradcrsitallding oi custoincr behavumH However, 
this i$ oficn flot easy to effwt becaiisc a£ the fotwal of the 
data. 

One ptoWem viiih laiown mcthtsds of fraud detcctjoa is 
that they M oftcD unable to cope adequately with Datutal 



{{) momtorijii the perfonnanoe of the first acural netwodc 
10 processing the ioform^tiOQ; 

(ti) crcaiiiifi a sccoDd neural aetwoik of the same topolosr 
as the fiist when a prcdetemiincd performance thresh- 
old is reached, and 

(iii) rctiaiaiog the second neural netwdc whfle oontinu- 
iog to pioccss the iDfotmaiioa wsing the first nevial 

This provides tbc advantage thai the first netiral netwoik 



uio. Lu^, -.w . can be tiscd 10 process the data ^^rtiilst the second Dfltiral 

changes in the input data. For example, a customer s tcle^ lo ^^^^^^ ^ being teuaioed. AJao, the secaad neural uetwotk 
phone call behaviour may change le^timatcly over iMie; the ^ retrained using separate processing resources from 

customer may travel abroad and make more bng distance a^ru^l nccwoik. For example, it is 

calls. This should not bo detected as an anomaly and be -jossible to uain the second neural network at a quiet node 
classified a& a poteodal fraud. Because the telccommunica- j*^ ^ communications network whilsi the first neural network 
tions market azc i» increaiang^ this is a particular problem a5 ^^^^^^^^ jata at a busy node. 

JEor fraud detection in telecommnnjcatioo*. Accordins to another aspect of the invention there is 

Known methods of anomaly or fraud detection which p^^jv^jcd a method of deriving output data from infibimation 
have used neural nciwoite. involve firet training the neural ^^^^ ^ transtnission of mcssaees in s communications 
network with a training data set. Once the tiainmg phase is flctwoik, using a neural octwotk, wherein the neural netwodc 
pvCT the neural network is used to process telecoms dnia in 20 ^ impkmcaicd using al least one instantiated objccl created 
order lo identify fraud candidates. As the behaviour of ^ghig an object oriented programming language, the method 

customers evolves, new CM input to tfac neural network — ^-.r__ r 

may be widely different from the original training data set 
Id these ciicumslances tlw neural netwozk may identify 
legUimate new patterns in the data as anomalies. Similarly, 
real cases of fraud may go unidentified. In this simation it is 
necessary to retrain the neural network using an i^tcd 
training data set which is tipdated to reflect new fcahires of 
the data- 
Several problems wise as a resnll of this need for reh^- 
iug. For example, a decision needs lo be made aboul when 
to retrain. Typic^ this complex decision is made by tbc 
user who rcqoires specialist knowledge not only about 
tdecoms fraud but also about the neural netwodc^ system. 
Because telecoms fraud is an on-going problem which takes 35 
place 24 hours a day, 7 d*.ys a week, it is often not possible 
for an expert user to be available, fins means that the system 

may "under perfbrm" far some time bcj&xe retraining is , 

nejwoA system needs to ^'^X^^ . KSS^^e^* ^wo^ be a q-kt 



SO 



comprising the steps of: 

(i) converting the object into a data stmcturc; 

(ii) staring the data structure; and 

(iii) recreating dio object from the dau structure. 
According to another aspect of the invention, there- la 

pcovidcd a method of deriving output data from information 
about the transanlssion of messages in a communications 
network, the method comprising the steps of: 
deriving the data from the informatioai using a neui^ 
network, wherein the neural network is implemcnied 
using at least one instantiated object created using an 
object oriented programnung language; and using a 
persSstance mechanism to store and retrieve the ob^t. 
TTiis provides the advantage thact if the neural network is 
implemented using an object ojiented programming Un- 
guage it can be converted into a form that can be stored. 
Once converted into data structme format the data structure 



Another problem is th;it the process of rctrauimg is itsctt 
ft lengthy and computatiooally expensive process- Whilst 
retraining Is in progicss it is not possible to use the neural 
networic system to delect aoomaUes. This means thai tele- 
coms Iraud may gp undetected during the retraining phase. 
Also, the retraining process may take up valuable processmg 
resources which arc required for other tasks. This is espe- 
cially important in the field of tckaiommunioations where ii 
may be required to site flic neural noiv«>rk system at * busy 
switch or node ia the telecommuncationB netwoiJc 
A further problem is that iotecvention and input from the 



50 
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other such event, a stored version of the neural netwojkcan 
be retained and then recreated into object form when the 
system is up and rurming again. 

Automatic rcuaining gives the advantage thai it is not 
necessary for the user to make a dcd^on about wben to 
retrain. "Hiifi removes the need for an expert user to be 
available to maimain the system while it is in use. Also, the 
retraining ptoceas itself is automatic so that vahiable opera- 
tor time is not wasted in performing a manual retrain. A 
further advantage, is that by making retraining acuiomatfc it 
is ensured that the outputs of the neural network are as 



can be inconvenient when it is occcsaacy to retrain quicWy 
and also requires a trained user to be available. 

SUMMAJtY OF INVENTION 

II is accordingly an object of the present invention lo 
provide an apparatus and method which overcomes or at 
kasi mitigates one or more of the problems noted above. 

According to a fUsx aijpcct of the present inventten, tl«rc 
is nrwidcd a method of managmg the prooesslng of infor- 



Monitoring provides the advantage that a value i& pro- 
duced which indicaies the performance of the neural net- 
work which is easy to interpret by a non-expert user. It js not 
necessary for a user Who has fipedalisi kncfwkdge about the 
60 neural network system to evaluate the performance of the 
neural network manually. 

According to other aspects of the invention there are 
provided corresporuiina systems. 
Preferred features as set out in tbc dependent claims may 



is provided a method ofmanagmg the P^f^^srog oi mror- ^^^^I^-^ ^^^^ ^t^ej. ^^th any aspect of the 
n^atinnt^rnsaflrstnem^netwod^tbe^^^^ « l^ve^utn^fa^^^ 

skilled in the ntt 



to the itansroission of messages in a tolecommumcations 
networic, the method ccmprising the steps of: 
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BRIEF DESCRIFnON OF THE ORAWGS Detection poll P^^iod-^ is a Mmc jf^J^J^^ 

Dtuiir whicdb iufbrmatiQn is ooUecied for mpfut to the anomaly 

Hie Jnvcaiioo will be fuutbcr described, by w>y of (jctedor. 

example, with reference to the accompanyitsg drawings in Protilc/signatnio— *his is 4 set of infionnatioo summaris- 

which: s ing aod desciiWos behaviour of va ifldividwal customer 

FIG. 1 is a gencnJ scheuiaiic di^am of ajt arrangement acoouot mB)hti over a given time period, 

for tbc detection of anomalies in data relating to the uaos- Anomaly— this is any itresular or unexpected pattern 

Kiisiion of messages in a cammunications Dctworic wiiHn a data set 

no. 2 is a general fidicmatic diagram indicating how the FCAPS Ajyplication Ftajneworksr-aystems for fault 

BDomaiy dcicc5tion engine is tised with oUwt components to lo managenient, configuration management, acoountjng 

create an anomaly deicctioa application. rpanagement, pecfonnancc matiagemeat and sccunty raao- 

FIG 3 shows lb© maio componcnis of an anomaly detcc- agerocnt in a oommunications nctwoik. ^ ^ 

Arse^oncnta. " tb= i^iual nrtwodc, huw they artangpd and how they 

FIG. 4 Shows the compc««oB of the <«g^^- « ""j^^jf^ » th. p»it of the «>Pinaly detector whid. 

isa,t,r the flow of mform;mon between th«e compo- « ^ (^dons. 

ntnts. GfMjhicaliisef interface (GVI>--lhi5 provides means for 

no. S is a general scbcmaifc <fia^am oC an ^-^S^m^t ^^.^^j^^^ ^^j, the user and the anomaly detector 

for the detectioQ of anomahcs m data rdaung to ^ tnms- ^jg^^^ screens. 

mission of message* in a cgmmimicationa network. ^nO, 1 stows schcmarically how an anomaly detector 1 

FIG. ^ iR a general ^liemalic diagram indicating how ^ ^ ^ fooeiv* informalion 1 about the trausmissiaD 

signatures are created. messages in a commnnioitjons network 3 and provide 

no. 7 is a general scbemaiic diagram indicating the rtports 4 about potential anomalies in the input data. The 
process of profile decay. 2S particular iostanlialion of the anomaly detector 1 is created 

FIG. 8 is a g/encral sciicmatic diagram indicating the a generic anomaly detcctioa engine (ADE) as shovra 

process of profiJe decay. in FIG- 2. This gives the advanwgc that the anomaly 

HG- 9 is a gencial lachfimatic diagram indicating the detection engine 20 is a reusable compooeat which can t» 

TMOce^ whcrtby each new type of call detail record inherits used in different individual appEcaiions. . . , 

fi^Tbase clws. ^ ^ ^® anomaly detection cngme 20 wbich 

HG 10 shows an example of a call dcUil fcooxd sped- contains ncwial network oompon^ts n. The neural^^ 

MO. lu snows ao cxanipiv component 21 Icani patterns in the iiiput mfbiroaiion 2 and 

ncatiOD- diffcnmcss in these patterns-^ anomaly caodi- 

FIG. U shows an exauipfc of a target can detail record o^^^ xhc ADE 20 dso comprises m«y other components 
format. fiu/«„„«h.,* as for example, an engine adtninistrator which is also refeaed 

FlG-a2showsanexanipfcof aprofile/sigpatuxe.^ to as an ADE manager. 

FIG. 13 is a general r^iiemaUc <fiagram mdicahng the is used in oonjimction with application 

different time periods u:jcd in calculating the day/night spedfic software 22. This is software which performs any 

period- data transfoimations that aro needed in order lo convert the 

FIG. 14 is a general schematic cfiagram of an arrangement ^ network data 2 to be analysed into a formal ibat the ADE 20 

for the deiecdoo of anomalies in data relating to the trans- can use. The application q»ecific software 20 also indudes 

mission of messages in a commnnicalions octwc«fc saftwarc to perform a validation of the anomaly Candida^ 

FIG 15 is a flow diagram indicating how previously- detected and also any software to convert the ADE's rcsailts 

validated candidates an. retained. into actions to b^ performed- n the AX>E is embeddedin a 

FIG 16 is a flow diagram indicating hew automatic 4S network manager 23 then too ^PP^^^^^P^f^^^™^ 

re^Sng u^ a daughtc? neural network talces plac«. 22 includes interface software to allow the ADE to be 

HG nshows an example ^lay sc^n provided by the ^^^^^^ ^ -^^^ ^ it a.ust be fnsumiatcd and 

GUI (Graphical User ^.rface). - ini^Sed into the u«r's cavironmem. By usi;ig an ADE 

FIG. IS Shows another example display screen provided ^^^^^0 in cotiiunciian with application specific soft- 

by the GUI. 22 a pardcidar instantiatiDn of an anomaly detector 1 

DETAU-EX) DESCRIPTION OF THE is created. This process of creating a particular anomay 

irrvENTlON detector is referred to as instantiation. FoUowmg 

Embodiment, of the present .oveation a» dc^ribc. ^'-T^^-.f" f ^ '^^^ 

ihc best ways of putlmg the mvcntfcn uMo practico thai «e r°,^yZ^iT^ar^Mtaii3Sxfely the AI>B is iDtegraied 

whenever a phone call w completed. The content ot a uuk aw^r »uiv^ ^ut^:^^ 

a3Rtotetp.ctc.--th«ex^«a5IU«i>dexttactsthose J^'^^^ jlwhtch lean, the data panems ot bebavtout 

fields necessary for anomaly detection. iwnipuH«i 
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mi detect the diffcrcQces in \hc bclmiour-thc anomalies- As time passes since the neural 

For . particular «iomaIy dctcciioo atuation a paniciUar grocraitrcn<fciutha dai»£rom th^oonffoumoitt^ 

aeurai network topoJogy vrill be most suitable. Also, the occiu. These trends are not taken accotmt of by the ocural 

acuxal network needs to be traitwd in order to have a set of network bccaijsc the neural network was not trained on 
wekhls thai eoRble adomalles in the input dau to be 5 data. In order to get round this problem the oepral network 

detected. If the ADE is simi)ly nsosed in a new siniadoD ihc ^an be cetrained. This process can be carried out automat- 

topolegy and weights of thf: neural netwotk oomponcnt* 21 cajjy usiog suitable appKcalion spcciJSc software- 

may not be appropriate for the new situalion. In order to gel As the ADE is wed, Cnrthcr iiifbimadon abmil whether 

round this problem whwi aa ADE is instantiated to form a anomaly candidates piodooed by the ADE are real anomalies 

paxiiciilar anomaly detector the topology of the neutal jjj^y ^ obtained by the user. Provisioa can be made 

network co£iq)anenis21 caji be auKMnadcaUy adjusted The j^j^ information to be input to the ADE and used to 

neural network coniponeDts 21 can then be trained or ^Jj^^^ ^ training data set and various other information, 

retrained to achieve a desired set of weights. Ibis piwuies ^ orocess is described in more detail bcbw. 

the advantage that the ADE can^N? wd in a vaneiy of j^^^'^g Coiupenents 

situations. The ADE can be appbed cr^-P™ua" and components of the ADE aie now described and 

-cross^au layer-. Cross-product tneacs that the i^Eca^^ later the proce^ of instantiating an ADE and integraiing it 

be applied to Eoote ^an one type of coinimu^^ ^^yf^^^^^ detail with lefefenco^to 

^ produj Cioss^ S t^ xSlc^ HG. 3 sb«^ the muu components of the ADE 

^:^ra^S:^SS ^ anda^otbeflowafi^frrmati<>nbe^.eentt.e^eompot.ut. 

A general overview of byw the ADE detcds anomalies is 20 The roain components comprise: 

now BivcD by xvay of example. The ADE receives input a profile generator 31; 

information 2 about the transmission of messages in a ^ pjofilc decay process 32; 

conummicatioD5 network 3- This information 2 is in the ^ j^^j^ transfbrmcr 33; 

form of call detail records (CDR's) and is pioccswd by the ^ ^^^^^ admlm&irator 34; 
ADE to form proWes (also referred to as si^atuie^ A 23 ^ ^ detector 35- 

proijBJe is a set of infonnaiion somroarising and descrilmig .^^^ comprises all con^oncnts inside the boundary 

the behaviour of an individual customer or account number 3 .j^^ ouhiide the bonniSary 30 lefeis to the 

over a given time period- Historic and recent fwofiles are particular insiantfauon of the ADE in appUcatiou specific 

frimed vrticm an historic jjiome retatcs to the behaviour of jpftwate. Data about ihe transmission of messages in a 
an individual customer over a certain period of time and a 30 ^^j^^y^nications aetwodc that has been piorpioccsaed into a 

recent proJ&lc relates to the behaviour over a shorter and ^^^^ f^^nj^ 3^ is input to the profile generator 31- The 

more recent period of time. Tbc historic profiles arc asBunwd ^^gi^ generator 31 forms historic and recent profiles or 

ID represent non-anomalous bcbaviour. By comparmg ibe gjg^t^^55S7^Sof theiuputinfonnationS^-lfneccssary the 

historic and recent ptodiles using the neural network com- ^^^jic profiles arc \qjdated with information from the 
pooenis 21 anomalies in the recent profile are detected. 35 ^^j^^ ^,^^1^5 ^j^ing the piome decay process 32. Informa- 

Many pairs of historic and recent profiles ate created and ^^^^ whether anomaly candidates produced by the 

compared and over time the historic profiles are updated ajjo^ialy detector are really anomalKS or not 39 can be input 

with noQ-anoEoalous in&nnation from the recent profiles, ^ ^ ^ update the profiles and fiir oUier 

Before anomaly dctcctjoo can lake place the neural ocl- p^i^poscs These processes arc described fiinher bdow. 

work components 21 mu«t be trained. The neural network ^ ^^^^ ^^^^^ 37 the historic profile 38 have 

c«mipon«it5 comprise a multi-layer perocptron neural net- created and updated as rcquiied, they are input to the 

work. This neural network is trained usmg a supervwod transformer 33 which lrwwif^wms them into a format 

training method. Itiis involves inputting a tcaining data set jeouircd by the detector 5, For example, a recent profile and 

10 the neural network so thai the neural neiwo* is^ able to ^ hjstoric profile pair may be concatenated* or the dilTerence 

buiW up an internal rcpreseniatian of any patterns inherent 45 ^ ^ profiles may be calcuUted. Other transfor- 

in the data. Tlie rrainina data set contains profiles and ^j^tjon^ ^ possible. The transformed daU 40 is uaed 

infiormation about whether these profiles are anomatous or ^ . ^ adminisirator 34 and the detector 35. 

not. This allows that neural uccwodt to kam the typical and ' ^ Adminisitalor 

exceptional bchaviourprofilesthatoccur in the network data engine administraior, also referred to as an ADfi 

and to classify them aocordingiy. Once *c neural Detwork SO ^j^^^g^^ responsible for the following tadcs: 

has been trained U is vaUrfatcd to check that the Uammg has tnumnz and/or retraining the neural network; 

been success&iL This is done by presenting a new set of • ^ performance of tbe ADE; 

profiles, that are known to be anomalous or not, to the ^ ZI^^zJlTy,^ ^^li network: 

Gained neural -^^i^' "Sdtt^^^^ .5 4 ^^ar^SntS a training daU set and an 

"^ifrs^^v^alt^ ''^X^norvalidaSfuscu. 

useTto^^oma^e^ New communications oeiwark ^^^^^^^'^^^^^^fj^^^^^ 

dftafautttsentcdtotibeAI^Ewhichusesibenewdatalofbrm a data mantvgcr 41; a traiamg Aetraiiung *^"? 

m^t^l nctwoTktte^ compares tbe recent evaluator 43; and a processor fcr crcatmg a neuxal network 

profiles with tbe historic^ profiles in Older to detect aootna- 60 44. 
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ml aaoaiilies or not. Hiese validated tcsulls 48 aw also ci«al« a lonlii-Uyer peroeptron type ocurat network. Olher 

icficncd to as "profile idfcutifieat»n and caiegoiy" infoima- lypcss of neural network such as a sdf-organismg map cauM 

tioo; they aie usBd to update the earample data 46, the be aeaud and used 1o detect anomalies. 

avaluatiOT data 45 soJ for other purposes as described Detector 35 „ ^ ^ ,u 

bcdow The evaltwiion data set 45 is created by spKlling the S Once the daU torn tbs two proJaes has been prepared, tte 

dcteeioD data sat 40 into two pari*; an evaluation data set 45 neiinil octwork has been created wd cv^uatcdby the 

and aa example or taimnj set 46. Both these sets of data admimstrator M, the neural net*o& 47 » smply ^»nted 

oootaln profiles atid infonoDtioti about whether each profile with the new deieelioa data 40. Rrf-w^S "Jl«- 

iihe set is anomalous or not. detector 35 receives ih« detection daU 40 and usmg Ac 

the example or uiininc data sel 4< is used ta liaia the 10 trained and validated neural network 47 eames otjl Uib 

neural netwoik 47 ttaioing ptoe«s«.r 42. Adding detection process to produce potennal anomaly candidates 

new ewwiples 01 anomalous behavtout 4S to this daU set 41. The neural tjetwodtdsssifles each recent profile either as 

enables the detection lo b« updated with new iafoimation. an anomaly or not and the ^ural "jj^* *J i^^*' " 

•mis aids the geiieral ptafotmance of the ADE; examples assodaied coofideoce vduefot eacbdass«&adoo^A«3m^^ 

fioiD £abe p<wltive identifications can be added lo the « threshold parametets 52 ate Injul to the delecl« 35 from 

Sample daiTsei to leducc the probability mat the false appHcatiao specific software These paiati« ets 

idcntScation rccuis. Addi.^ rcsuUs bom positive identifi- to filter the ^tent«l womdy c^^^ tL J^te ^1 

cations reinforces the ability of the neural natwoik 47 to majority of fitbc poatwc "d-^^lfi*^- f 

make similar positive identifications. aoimaly candidates with a very tow oonfldencc rating could 

^CSS:^b;^*cADEtolea^.orrelca,n. " ^S^^"^ Intcgrating the ADE to Form a Specific 
a particular task. To obtain the optimwDpeiatmance from Anoroaly DetcctiOT Apphcanon __^„„^w^k„„ 
"h» ADE. a representative .lau set 46 needs to be presented The ADE is a bbiary of sof ware cotnpooents ^^J^ 
dwios tfainiM. Ihii training data set 4$ should mclude be tised to delect anotjiabesm data about theuansmission of 
examples Tiomaloos c«nts as wH aa non-anoroalmis 24 messages in a comtrtinicatwos network. The compon^ 
evcnteandpfeferablylnarropoitioothatistepreaeaiaiiveof need to be tailored for each spiwifio apphcation and ooec 
the data set to be analysed by the ADE. The neural network Instantiated form an en^ ^ ^ 

4^ rS^sd using a ItLJng algorithm. Many difBcrent into a software system. The ADE has an apphcatu»pio- 
jlSns algodth^can be u^ aJin a pi^fened example grammingilitetfeoe (^'^^'^^i^'^^l'^''^^'^ 
a notHparSieteriscd learning iwle, the known sealed conju- so 22 oommamMteswith the ADB vu ft^ API. 
rate (saffienl alBorittan, i! used. Condition parametBR 49 js^lication Programming Inierfece (API) 

i,^ ifS^^tclxaiuing process 42. These param- He API enables 8 dafaent method caXs to «» 
e«iL^ be%« by^he user o? Saf be predefined. They the ADE fa,m the appbcation specific ^f^" 22^7^*'^ 
include infomiatioo specific to the irainingteiraining pro- 8 diffiweut msliuchnns can be given to the ADE moludrng. 
oeas such as hnw many training epoch5.*ould be carried out » l. CpeatoAnomalyDctector 
and whether early stopping should be involsc* Retraining 3. TrainAD 
can be carried oui automatically without inlsiveation by the 3^ PerfonnDelection 
user as described below. This is done by wins H)eeially ^ EvahiatePerfonuanee 
adapted application spedfic software. The pivxss of ' g^^uang 

retraining can involve the creation of a s^oad neuxa^ *o XldKnowledfic 
network that has the same topology as the original neural f^^^^T^ 
nctwoA 47 and tetainieg the second network. Th>» is UpdatePraflies 

SSan^SJ^ ?i.ei'^cdo»s are eMiijples only and other types of 

^rr/S^a^attalned. a validation process 43 AS instructions oould be used. Each of these 8 insimcUons ate 
is used to determine the performance that the ADE has for now described: 

the naiticulat task. The Mtfoimance of the ADE is deter- CicateAnomalyDetector ^ . u , 

mL^Xpt^S the JvSoD da.aset45 to the neural This instmction requires that information iOiou the looa- 
S^i?47 SSg tite SLlonnance evaluatnr 43. The evalu- tion of an anomaly detector creation speciflcatloo and a 
^^fatt s« 5l^n^T«fll«'» «"i information about 50 training data set is supplied when ^ "^^^^ 
whether the« profiles are anomalous or not. The profiles are This inlbtmatioa is suppbed by fl» »PP^«on, 
S«^d» lKtraloetwo.ic47 and the anoialy candi- 

dM« Seed by the ne^ir al network 47 are compaied with a GUI. When this instnustion is pven » the ADE m 
S^lSdouipuB by the performance evalualor 43. The anomaly detector fe created which indud« a newo^ 
SS^^al<««ih?nc.lcul.t*s a value 50 which 55 b»«* ~ '''f <f ''^ *'Jf^^^^ 
Sfca^ level of sfMadty between the ac«al and TTieanomaly 

cxpe«edoutp».sort|«n^«^o*^vahic^ «^V^ Z= rd^d'^.l^^fthl 

r'ltrV^^Sf^Sr Zn^yd^rhasbeencrealedasignalisrcmrnedtoU^ 
""V"? ^!:^^Sr;T;^^E a separate neural «, applicaL ^cific software 22 .0 indicate that the neural 
netwoik 47 fa required. The neural nerwoik creation process network js ready. 

44 creates a neural petwtirk of a given internal architecture. TrsunAD ,^i„t„„ „mr.«»= *> 

T^rnr=^ofl ntoccss 44 createTa multi-layM peioeption This iestniction causes the tf»J,nmB/retratofng process 42 
JS^n tCiSS^rWh- or not &!lly wra^ «« or retrain the ueur.l network usmg *e^«»S 

Weat^ with diffet^tit numbers of input. 55 set and a^ T'°*?^-*^2?'^rl!];^d^S^ 
^Ju^ hidden units. The number of hidden Uyers can network h» J^*^ °!^^^^^'^ri«^ 
alsb be varied. U is not essential that the weatioo ptoccss back to the appUciaon qieciflc soHware, wis inctuaes 



PAGE 76I82'RCVDAT5(4I20I)47:09:27PM [Eastern Daylight Time]*SVR:USPT0{FM-1/rDW 



05/04/2004 19:12 617-832-7000 



FOLEY HOAG LLP 



PAGE 77/82 



6,067^35 



U 



12 



10 



informatioa oboul Uje locatioa of tbc trafuedl/rctrained neural 
netwoik and a classificatioD cnor. Tic clasaificatioD error is 
a value wMcb indicates the propaition of inpiits that were 
mi5daflsifi<?d by the neural network during an evaluatjon of 
the performance o£ the neural network- 
PeiformDetectiian , 

This iiKUuciian requires that informatioD about toe loca- 
doa of a detection daia set 40 is provided to tbc ADE. Wl}cn 
this instruction is given tbe detector 35 in the ADE pcifonus 
a deUclioB uiuag the supplied dctectioo data set This is the 
normal mode of operation for the engine. A series of real 
prcscntetions are supplied, which ihc neural network 
attwnpts to classify as being aoomatxes oi not- When the 
detection is completed the APE returns a data sei to the 
anplicatinnspccifi*: software 22. This is a list showing J5 
Stegpry (anomaly or not) tbe ADE dassified each input into 
together with a confidence ratii^ for each classification. 
EvaluatePerfbrmance 

When this instruction is given to the ADE tbc perfor. 
tnance evaluator 43 canries out an evahialion using the 20 
evabialion data set 45. When the performance evahutioa is 
completed a classification <nror is returned to the application 
spe<n£c software. This gi^es an indication as to bow many 
mis^classifications wt;r« made by the neural network. A 
mis-dassificatian occurs vrhen the nenral network petnras a 
detection result based on ;i Jmown inpui-outpul pair; whicb 
docs not mate* the concci output tor that particular input. 
SwitchADs 

When this instruction is given to the ADE a tccenuy 
trained ficcoud neural network (that was created during the 
retaining process and is contained in a second anom^ 
detector) is switched with the current arstive ncwal network. 
That fe, the current active neural network is replaced by the 
newly trained neural network. If a switch is attempted before 
a second neural network has been created an error mi^sage 
is rcmmcd to the application specific software 22. 

AddKhowledge ^ ^ ^ i 

This insiructjon requires that mformation about the loca- 
tiou of a data set contjiining vulidaicd results is 
provided with the instruction. When die instruction is grven, 
a retraining data set is created or updated within the ADE 
osing the new infontnaiion. When the updating process » 
completed information al)oui the location and cjdsienco of 
the ictaining data set is returned to the application specific 
software. 

UpdftteProflles t«,. 

This instiuclioo requires that infijriDaiion about the loca- 
tion of the presentation data set to be provided when the 
instructioa ^ given. When the instruction is given the 
historic profiles are up<lated using xnfornjatioa from tte 
xcccnt profiles using the jjfofilc decay process 32. When the 
updating process is completed information about the loca- 
lioo of the updated pre^-ntation data set is returned to the 
application isped&c fioftwate 22. It b also possible for ihe 
leoeni profiles to be updated with carrenl iufoimadoo as 
described below. 
DeletcAD 

When this instruction is given ihe anomaly detector is 
deleted- Any memory tlwt was used to store the anomaly 
detector is released. 

Preferably the API (and the ADE) is created usujg an 
object oriented progratncning Unguage such as C++. An 
objea leferred m as an AppUeatienHridgp object la provided 
which makea available e^cb of the 8 methods or instrucnoos 



create further software which inherits from the ApplicaUoii. 
Bridge object and overtoads the remm event methods. It is 
□ot esficndal however for the AH and indeed the ADE 
software to be created using an object orienuwJ programming 
language. Other programmiog languages could be used. 
Anomaly Detector Qfcation Specification 

This contains ttuce parameters and infotmatton aboul the 
location of a oouml network creation specification. Ptcf&r- 
oWy the anomaly detector creation spccificaiioa is an object 
created using an object oriented prognunmios language. It is 
iKed by the ADE to instantiate aU the C++ objects. The three 
parameters are: . 
1 an update ^tor — this specifies the update factor that IS 
' to he used in the algorithm for Updating profiles as 
described below. 

2. a retrain facior^-thU is a threshold which must be nwt 
before rciaioing takes place. Bor example, it can be the 
proportion of retraining data to origioal training data 
required in order to make it worthwhile retraining. 

3. a trainhjg data patfamclcr— this is a threshold 
* which must be metbcfore training occurs. It reflects the 

confidence in the training data and tbe neural network's 
abi% to train on a restricted data set. This value is the 
minimum amount of original trainicg data required 
before the neural network will be trained. 
In order to produce an anomaly detector creation speci- 
fication it is necessary to first construct a neural netsvork 
creation Epeinfication. 
Neural Network Creation Specifitation 

the neural oetwork creation spedfication contains infor- 
mation about the location of two other specifications, the 
layered oetwork specification and the network trainer sptci- 
ficalioo. Preferably the ©eural networit crcetion specification 
is fbrmcd using an objea oriented programming language 
and is linked to the anomaly detector creation specification 
object, e layered network spedfication object and a nerwdc 
trainer specificatioo. Tbc Uyercd network specificarion and 
tbe network trainer ^ccificaiion should be created before 
the neural network creation specification. 
Layered Network Specification ^ 

This contains the specification for a particular type .oi 
layered neural networit A list of three values b given which 
specify: 

1. the number of units in tbc input layer; 

2. the number of units in the hidden layer; 
3 the number of units in the output layer, 
A list of wci^ts can also be given. This is a lisi of vahjes 

for each of the weights between the connectioas in the neural 
network. If tlxe specification is &r a trained iwuial network 
50 thenalistofweightsniusibegiven.lfthespecificaiionisfor 
an untrained neural network then no weights are necessary. 
The number of input units is determined with reference to 
the number of attributes of the input data that arc deemed 
sianifijcant. The number of units in the hidden layer can be 
53 determined either empirically or by statistical analysis oaag 
known methods. The tnmjber of units in tbe output layer 
depends on the number of classifications the user requires 
for the particular task. It is also possible to spcwfy whether 
the neural networit shouW have a ftiUy-connccted arcbitec- 
60 tare or a partially connected ardiitectuic. If a partiaUy 
connected architectuic is selected the ^ecxfic conoeciions 
are specdfied in the list of weights. 
Network TtainCT Specification 
This contains information required by the neural nctwofK 



45 



whkhmakeaavailablee^cboftheStiielhodsa^ durini training. 7 parameters are included: 

described above. Each of the 8 methods has ^i_a£Sociaud « ^^^"^^^^ . ^ .^^^ v 



valid "rcturo evcai** method. In order to add fijrthcr capa- 
bilities required by a specific applicatron the user must 



1 target ertor— this is a threshold enor vahic which must 
' be achieved before training stops. If the target error is 



PA(£77/82'RCVDAT5/4/2004 7:09:27 PM [Eastern Daylight ^^^^^ 



05/04/2084 19:12 617-832-7000 



FOLEY HOAG LLP 



PAGE 78/82 



6,067^35 



13 



14 



set 10 0 thCD the thKsiotd i& igoorcd. The t^Tgpt «K)X 
is spcdiied as tbe &um of squared eirors over the 
training set. Thai is, tbc trHiniug set is prascnted to the 
Dcaral nctwoiic and the output values aro subtracted 
from the expected output valves to give a set of errors. 
The swn of the square:* of tbcSA errors is Ihwi calcii- 
Utcd. 

2. pcnxDiag^ validatioa—this fifpecifics the percentage of 
trwinnis data titiat wiH be regarded as vaHdatjoo daw 
and win ooi be wd for trainiiig. This partuneier is only 
sigtafioani if early stopping is used. 

3. is-early^stoppins-required— this is a Boolean value 
' which jodicaics whether training should be stopped 

early ui order to achieve generalisation. In niosi cases 
tihis is set to Hue. Eaiiy stoppjug means stoj>pi»S ^ 
trainicig process cailij^r than usual so that overfieiiiig 
docs 001 oocuL If l\K neural netwotik is trained too 
much it win not be so (pood at generalising or produdog 
Ixssl guess" results wlien new data is presented. This is 
because the training cala has been ovcffitted or learnt 
too specifically. 

4. numbcr_»o£ trdning—irydcs — this ^cdfies the mimber 
of training cydes thai: wOl be performed- If this valuA 

set to 2txo (be neural network is cctrained. Thai is, the 
weights attt not randcouised beibrc training begins^ 

5. random^ed— this seeds the randotn number genera- 
tor that is used to imtlali&e the weights and choose the 
validation set. 'When this value is set to -1 the tajidoro 
munber genoralor is seeded using a value derived from 
ihc system dock. "This maximises the uiy?redictability 
of the generated numljcrs and is the usual vahic for this 
parameiei; When this value is set to a positive number 
this vahic is used as the seed. Thi^ option is intended for 
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be insiaotialed and used to dcie« fraudulent usage cm a 
mobile telephone or fixed telephone nctwodc. Also, the data 
to be loalysed by the ADE is in the form of caU detail 
records wtiich have been pre-pioccsscd into the format 
required by lh& ADE. 
The steps involved in the instantiation process mdude: 
anange for the application specific software to supply the 

CDRs in the concct format to the ADE 
create an anomaly detector creation spcci&catiaD (this 
includes the step of crcadng a neural network creation 
specification); 
create the anomaly detector; 

create ihe training data act, validation data set and prc- 

sentatioa data set; 
train the neural networic; 

When these steps have been perfbrmed the instanUated ' 
ADE is ready to detect fraudulent telephone accounts. The 
application specific software should also be arranged to 
allow the other instructions or method calls (add tocwiedgc; 
retrain; switch; delete) to be sent to the ADE. 
Creaie an Anomaly Detector Creation SpedficaliOD 

This entails determining the values for the various parain- . 
eters. In this example the ADE is formed using an object 
oiientcd programming language. In this cases a call is made 
on an anomaly detector creation specification object 
stnictox- Th^ causes the anomaly detector cieatton specifi- 
cation to be created. The parameters should be calculated 
prior to the creation of the anomaly detector and inserted 
into the anomaly detector oreatiou $pecificaiion. The opa- 
mum set of parameter values should be used in order to 
obtain the best detection results. For example, ibc number of 
output units for the neural network is determined aooordiDg 
to the type of data being analysed. Fbr fraud detection two 



djis vahic isused asihe seed. Thi^opdon is intended for ^^^^^^^ ^ ^ ^ £^ f^^^ and one fci non- 
purposes such as rt-grcssion testing and debuggng ^ ^^^^ analysis of raw network data is required to help 
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wber« the same sequence of pseudo-random numbers 
may be required every time. 

6. max_numbcr^f steps— this parameter specifics the 

number oL' steps that the irEiiner can take. If 
this parameter is set to zero then ihls test is ignored. 
This is the usual value for this parameter. A non zero 
value indicates the number of steps at which to stop a 
training cydc lE it has cot stopped previously for soroc 
othei reason. 

7. fraciiOQaLjtoleranoc^his vahie indicates a threshtdd 
fi>r the amount of improvement that should occur as a 
result of one training step. When the threshold is 
reached training stops. A zero value indicates that 
training should stop when a step produces an effect that 
is smaU compatttd with the accuracy of the fioating- 
point calculations. A noo zero vahie indicates thai 
training should stop wben the lelaiiye improvement as 
a result of a step isbUow the value given. For example, 
vahics in the rat^e 10-2 to 10-6 ate suggested. 

The ADE is generic in namre and requires an additional 55 
layer of instandation software (or qipUcation specific soft- 
ware 22) to provides further fundkmality. For c;cample, ihe 
XDstamialinn software may provide a OUU data pre/post 
processing aud interfaces to the external world. As a mini- 
mum ccquiremcni the itpplication specific software inust 
aUow the user to give any of the 5 API method insitucuons 
or calls to the ADE. The parameters (equirtd by each method 
call must also be pro-zided in the coriect format For 
example, historic and reocnt profiles must be of a specified 
format, as must any specifications aad data sets. 

The process of instantiating an ADE win now be 
described by way of example. In this exan^ile the ADE is to 



fraud. The analysis of raw network data is required to help 
in the definition of the key atiribute/ficlds and values that are 
needed for the anotnaly detector specjficadon. 
Create the Anomaly Detector 

The anomaly detector objects are cieated by giving an 
iosiiiiciion to start the CreateAnomalyDetector method and 
supplying infoiraadon about the location of the anomaly 
detector specification and iiaiaing dau set. ^ . 
Create the Training Data Set, Validation Data Set and 
?rcsentadon Data Set 

The CDR data must he iransfotmed in order to proauce 
the training, validation and detection data sets. One 
approach for doing this involves: 

5plitting the CDR data into 3 sets, training, validation and 
detection, whereby the trainii^ set is snbitantiany 
larger than the validation set 
deciding on smaU aibhrary window sizes for the histori^ 
and leccot profiles. The term window size refijrs to the 
time pcripd over which the profiles represent telephone 
call behaviour. For example, £6r a 3 month supply of 
CDR dau, the historical window size could be 5 days 
and the recent wintlow size could bo OS days- 
Selcctmg attributes from the CDR data and fijiming the 
profiles as well as labelling each profile as to whether 
it is fraudulent or noL 
Training the neural network with the new training data set 

aud observing the detection results. 
If the neural network pcr&rmancc appears relatively k)w, 

gradually increase the windows sizes and rcuain. 
If the neural network pcrfonnance reaches a level 
Inquired by the user then the window siaes arc deemed 
concct and are used for profiJes to an data sets. 
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The cieatioa of a histojic jnofile far a Qcw customer 
accounl needs to be done al th« iosiintiation layer 
(applicaiion specific ioftwuc). The historic profile should 
be a c&cci copy of iha r eccjit profile wiUs a lahcl W indicate 
thai i! is a new customer accounl. Also, data for a profile 
needs to be coisecutive, i.e. if it is detcnnined that a receot 
profile required 5 hours of data, then 5 oonsecutive hours 
need to tK used for the recefll profile^ nolju^ auy 5 bouts. 
TTxis roeaos that gaps in the CDR data may cause -pfohlcjns. 
Howcvttf, chis depends on the relative size of the "gap". For 
cKaxnple, if them is a one hcwr gap in a months worth of dau 
then ihsr© is unlilcely to be a problem. Another point is that 
the windows siz«s for the hirtoric and recent profiles must be 
for onnsecwive time pctiocls. For example, the hisioiic time 
period may be from Januartr 1 to Januaiy 31 whilst the tecenl 
profile window is £fom Jajmary 31 tn February 5. 
Tfain the Neural Network , 

This process invohres cyclically adjusting ibe wcigbis 
stored on too oonnecdons between unite in the neural 
network, until :aifBdcjit trdimng has been performed. This is 20 ^ . 
done by sendii^ an Insiniction to the ADE to start the 
TWnAP method. 

Once the ADE has bdjn instantiated or tailored Cor a 
specific Miplication it is integrated into the sysuan software. 
-E^do this integration code is used to bridge froni the tailored 2S 
ADE to the system softwaic. This integratioti code is apph- 
caiion specific Many difisrent possible forms for the inte- 
gration code w« possible. Th^ ict^tioD code should take 
account of the following issues: 
managemeni issues 
architecture issui^ 
software issues 
data issues 
Management Issues 

The integration softwiut: must manage the ADE. The 
fonctiODS which musl be performed wet 
Monitoring the pcrfomianoc of the ADE. Hie applicaiion 
which the ADE will be used in wiU need lo detciroine 



will need to be accessible by the user at some point 
after siart-up in the following situations: system crafih^ 
process killed and pee(b to be te-started. 
Stotfage of ihfl historical profiles also needs to be consid- 
ered. The bifitorical profiles wiJl be stored externally of 
He ADE, and accessed when required. 
Storage of the original training data set, and the additional 
koowledgp (data) galheicd throng use of the ADE is 
also required. The additional knowledge is needed by 
the ADE foe re-training, in order to improve its fuhire 
performance. 

Deletion of any objects output from the ADE— deteccioai 
results, any daU sets, and the anomaly detector ^>cci- 
ficatioD. 

Any objects which arc passed into the ADE will be 
deleted by the ADE softwan^— training data set, daU 
input to use in detection mode, any knowledge added, 
the profiles, and the anomaly detector specification. 
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The intcgratioa software is responsible for 
Maintaining an appropriate set of data for initially training 
the ADE. This process must result in a data set whose 
data covcia^ is sufBcient to flUnw sucoessfid trainiflg 
of the ADB. 

Maintaining an appropriate data set for retraining the 
ADS, Additional knowledge must be obtained by inter- 
action witti the user. "Iliis koowkdee must be obtained 
by interaction with the user. This knowledge must be 
used to form a retraining data set which is to be utilised 
when arequcsi is made, by the usee, to add knowledge 
back into the ADE- 
Updating historic profiles over time. This is done by 
allowing the recent profile daU to migrate mto die 
historical profile. This xclies upon the recent profile 
being assessed as non-£raudul«nt, as it would be 
couDtcr-productive to aUow a uon-fraudulcnt histoi^l 
profile to be updated using a fraudulcut recent profile. 
Some form of feedback loop is therefore needed in order 



which the /pB WiU be used in vriUce^^^^^ fi^^ fraudulent profiles output by the insiantiaiion layer t^ 

the appropriate Pcrft.tmatice me^men^ ^ verified, -me rLullant frJid candidates win need to be 



will retuni a mis-classificaiiofl value when a pcifor- 
mance evahiatiOD is requested. This mis-classification 
is obtoined by presenting the training set together with 



be veiifiod. The rc&ullant fraud candidates win need to be. 
assessed and the results of the assessm ent will need to be fed 
back into the instanh'aiion layer in order for the correct 
nrofile adjustment to be made. Any non-fraudulent output 



counting how oiany of these «c S«'« ^ .acoirecl 4$ wiUt. P ^^^^ 



tcsuli. 

Deciding the thresbol<l perfi^rmance level for retrahjing. 

Deciding when to retrain the neural nccworit. 
Architecture Issues 

Architecturul considerations are: 

How to access appropriate data stores in order to provide 
necessary input dau fiom which to perform detection 
and where to locatis data stores, either locally or dis- 
tributed. 

How to update tbc pecsistent store of the ocural network 
creation specifications which is part of the anomaly 
detector spcdficatifjn, when the ADE is retrained. The 
spedflcation is passed bade throtigb the APJ when the 
tnining ^s complete. 
So Beware Isisues ^ , 

The integration code can have the following funcnonahty: 
U the ADE is event based it may easily be convcrted^to 
call-celurfl form by writiQg a smaU amount cf interface 
code. 

Storage of the anomiJy detector specification data needs 
to be considered. The inomaly detector spedficauon 
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without the ntscd for a vididation step. 
Assessing the raw communications network data. This 
can eithtsr be a manual or auioroatic process of obtain- 
ing account detaiU from the appropriate communica- 
Hons network. 
A particular example of an instantiated ADE will now be 
described, la this example an anomaly detector is fcrmed 
tising an ADE together with application specific soft^^tc 
which makes U possible for automatic tetramtag of the 
neural network componcnis to take plaoe. In this example^ 
the particular instaniiaiion of the ADE is refeircd to as a 
kernel within tbc anomaly detector: The major components 
of the kernel with rcsjwci to tlie fraud detector application 
domain, are set out in Appendix A below. 

FIG 14 shews schematically how the anomaly detector 
201 can be used to receive infioftnatjon 20!2 about the 
transmission of mess^ in a communications netwoik 203 
»Dd piovidc reports 204 about potential anomahM m the 
input dau. Validated results 20S can be provided to the 
iuwmaly detector 201 so that the performance of the 
anomaly detector can be cvahiated. For example, in the case 
of tdccommunicattons fiaud detection the anomaly dci&ctor 
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201 identifies potealial fraud aod non-firaud candidates. 
Portbcr iofonoaiioa 205 about whtthci Uitsc candidates 
havd been oartoctly identified as frauds car non-frauds is then 
obtained foe exampte from ibc user, and iajnit to ibe anomaly 
d«4ccior. This inJattnatioD is used to ev»lual6 the pcrfbr- 
manoc of the anomaly detector. This provides the advantage 
that a measure of the detccuir's perfonnance can be obtained 
easily. Oocc the pcrfonDance falls below a certaia pro- 
defined level, adion can be laken to improve the perlbr- 
mance as long as certain other criteria ate also mcL This 
action involves leiraining a ocucul netw)rk261 wdiich fonns 
pan of an anomaly detector kernel 206. Once the perfor- 
mance drops below a ^sdfied limit, tetraining can be 
initiated antomatically wiihoui any inlervcntion froro the 

user, I 

In the situation where the performmce of the aoornaly 
detector 201 is satisfactory, no fetaimng takes place. This is 
illnsttatcd in FIG- 15 at 22H. In this situation validation data 
has been provided aJrhougTi the neural neiwoi^c 261 b3s not 



pcrfbroaiog an Anomaly Detection 

The kernel identifies via the systero clock that a dctccuon 
poll period has been reached. If the kernel is busy when a 
poll detection period h reached then when it tK:oonws 
5 available it waj get the current ticne,Ifthi$ time is kss than 
the dock interval (plus some overhead time) then the 
detection is serviced else the poll delecUon hmn been missed 
and tbc kernel sends a message bade to the ^apbical^ 
interface (GUI) to indicate ihat a poU detection has been 

10 missed. ^ . . , 

If a detection is to take place then the kernel sends 
ta&rmatioB to the GUI to indicate that the kernel cannot 
accept any fortbcr commands until the detection has been 
completed. , . 

15 The keraej accepts input information that is uipat to the 
anomaly detector. This input information is initially m the 
form of call detail records for those customer who have 
ipade calls during the poU period. These call details records 
are pre^rocesscd before being input to the kcmcL The 



l^beenpwmded ^^^'^^ fVf^ZT^^ 20 i^i^o^^n^ any father ^loce^dng of «» mp»t 
been iipd^ed ^Ong^toe r»^^f?±'t3?S.5l'?r^!^ ^ S,.tioa before ihfa is provided «s fajnit to the deuol 



the neural network 261 has not been xetrained 21 is not able 
10 take acconni of the new validation dau 20S. When further 
results »ie obtained from the anomaly detector 201, these 
will not reflect the new iafoiinaiion and the user may be 
presented with results ihat she has akeady cooected before. 
In order to avoid diis problem, the anomaly detcrtor 201 is 
able 10 store validated «l^nllts 221 between retraining epi- 
sodes. Tbis store of validated results^ is then used, as shown 
at 222 to update any fiirther output from the anomaly 
detector before tbr> is ptesented to the user for validauoo. 

The anomaly detector 201 also has the ability to create a 
daughter ncwal network of the same topok>gy as the parciii. 
This daughter can then be retr aincd whilst the parent is stfll 
in use. Once the daughter is retrained it oun then be used m 
place of the parent, if tb-i perfonnance of Use daughter \s 
satisfactory. This is illustrated in FIG. 16. ^ _ . 

It is not efisandal for the validation data 205 to be 
provided by a user via a user interface. For example, the 
validatinn daU could be obtained automatically and input to 



information before this is provided as input to the neural 
network within the kernel The neural network then per- 
forms die anomaly detection and ompnis a set of ^ifulto 
ihe kerne). The kernel then Stores ibese results m a file and 
45 sends information to the Gtaindicatins that the detection IS 

oosnpletC- 

Prcsentins the Outputs From the Anomaly Detector to the 
User \ia a User-inlcrfacc u % 

When the GUI receives information from the toeroei 
indicating thai a new detection resuhs file has been created 
it indicates tHs to the user. This is done by highlighting a 
retold bttitOD on a display screen. By aciivaiing this button, 
fior example by cUcJdng it with a mouse, the user can displ^ 
the results file on the screen. FIG. 17 shows an cTcample of 
ij 5uchadMay.Thensercanmampulaiethcwayinwbichthc 
results are di^byed usin^j theuscrintcrface.Tbe user is also 
able to generate a graph displaying the results lofoimatioo an 
shown in FIG. 18 and independently to change the viewing 
criteria for this graph without affecting the table of results. 
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validation dau («uld be obtained automaiij^^^ Ac«5epting Widati^d Results or Target Outputs Fiom the 

the sysum directly. Also, H^^a^^^^^ 



octwoik to form part of an anomUy detector. The neural 
netwoik could be used for pfoccssing data for another 
purpose. - . 

The process of monitoring the performance of the 



User Via the User InleTfiit:e , . 

Wbea viewing the detection results on the tabic view as 
ehtfwn in HG. 17, the user is able to indicate if individual 
responses were correct or incorrect For example, the table 



m prooesB of monilorins «1» _P'?*»™''°f*.^' "Jl! ^. jAO^a in HG. 17 has one tav 241 lor csdi aistomer 
^ai;detectt)xwiUnorvl»describeduimorc<fciafl.Tb.s « ^,^^^,,„a„v,ri„^colun.ns of tillable 242 Uk 



comprises: 
changing oonfiguraHon infiormaifon 
perfonning an anomaly detection 
presenting the outputs from the anomaly detector to the 

nser via a user interface 
accepting validated results or target outputs ftom the user 

via the user imcifaix 
evaluating the pBrfbmancc of the anomaly detector 
Changing Configuralinn Information ^ 55 

The user is able to chanp^ the folkiwing settings during 
operation of the anomaly detecton 
(D die evahiatioo interval i.e. the number of sets of 

validated results that must bo ^applied to the anomaly 

detector before retraining can be initialed lutomaii- » 

colly; 

(ii) the start data and umc for perfonnance of an anomaly 
detection; . ^ , 

{iiO the performance threshold i-e. the threshold below 
which pcrformanos of the anomaly detector must fall 65 
before automatic retraining is initiated. This step cl 
changing the coofiguration information is optional 



account number. In the varioiss cohimns of the table 242 the 
following information is provided: 
the customer aooount number; whether this aooouni Is 
identified as a potnnUal fraud or nol; the confidence 
laiing of the ficaudAion-firaud dassLfication and the 
^erage duration of a telephone can. Other infonnanon 
couM also be provided, fpt example the average dura- 
tion of long distance calls or information about geo- 
graphical location. The validity oohimn 243 displays 
ipformatinn that the user has input about the account 
number concerned. This information can bo added to 
the kernel's knowledge base. The user is able to select 
individual accounts and validate the anomaly detector s 
response. When the u«cr has added vaKdation iuforoia- 
cion for a number of accounts this can be aikicd to the 
engine's knowledge base. Ibis is dotic by activatuig the 
"^dknowledge" button 244 on the user interface as 
shown in FIG- 17. When the user activates this button 
the GUI sends informadon to the kernel about the se; of 
validated fraud candidaies for all tboM accounts which 
have been vaUdated and all other oon-fraudulcnt 
accounts. This is called an add knowledge event. 
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yaddinfo«n«ip-abo«.U«v^J»«lfc'-i-°did^ ^^^^5^"^^ ^J^'f^cSe^ ot groups of 

■"to tb« anOTMly detector'* knowlcdgo ba»; S J^^le^rT^ed iato dau sUMCt«cs vising the 

(3) \^xlawprefiles; «rsistenoe mechuiisa» in ctfder th»l they c»tt be sored or 

(4) evjluue the peifotmiinee of the wioaaly detector. Tte dStT^otcs eu. then be passed between 

(5) rciraitt the peural netwoit . ^ . nmeeasors For ejaowle, these miy be diSEeieoi node* on a 
k«io» 1. 2 and 3 ibnve myrt be performed v*ereas ^.^^^^^^J^Sa-TOs proxies vario«advanUg». 

actton* 4 and 5 art condmooal. r*imnle a dauahier neural network, ooce created, caa 

Stot« or Retain P^vioudy Validated C^d^^ beS^ a da^^^ «d«.oved toa qtactnodcin the 

When an '^^^'>rf'^^T^t^^n Z^^^^ i>ctwodt befo« being retrained. Abo the 

needs to tnaiotoin » list of all »5"V^'?«r^5^J^„ f ° part of the anomaly detector can be moved 

vrtidated wd the condition as»«ated vMh that account, for ^^J^f ^ ?^ ^ oo„nmmications i^twotk whilst 

=«nipte, whether a fraud w«i coirecUy identified » sodL If »s » » P?!^" ^"a^yXector such as the GUI a»« 

ihe ADomaly Dclcctoi's Knowledge Base 20 !?!?^I^^ti^^ network. A wticulir cxainplo of ^ 

J=Kbcrof addtaolrledgeeven..«hichb.vebeen the anomaly detector 
peifomiBd. js 1(H can be vscd to receive infonnatioo 102 about the 

Update Proflles w4rf^>,i „rftfllc for those traosinission of messages in a comnWiBcatioM net"** 1^ 

The kernel updates the historical proiuc TlrJ^j* t^ti» 104 about potential anomalies m the 

acco»ntswhicharevalidatedascar,ec:noj.^aud<^^ ^L'^SI^I J^l^^i^^of 'teleo^unications 

,nd those whidj arc validated as mccfftect fraad candidates. '"P* J^*r ^ loa can be in the form of call detaU 

^ ken,el als, updates tl.e historical profiles foi the ether ^^^^^^^^^^ CDB* from different tele- 

noD-ltaudcaiuMates.mtert»lmat<Ae8thereeentp^^^^ "^^S^sy^Te^^'od the anomaly detector is 

with the cuatomer'a historical profile aad tbenpioyides ^^^^ITfaTdven time period eaU detail 

inforoaiion to another process which updates the h«onc>a ^ w XbTaSiedfer tatephone caDs Sutde during that 

p«m«with*«corre^o»^e<^t p^^ ^ O^K's 

hislotical profiles are then stored by the kernel. w ..ivUHsinmer »od eenerates a aanahiie for each cus- 

Evaluate L Performance of the Anomaly Detector « to^"'^"-**^ A S of CDR'* for an 

U the xmmtct of add ioowkdse events -s oqi^toje StS^ HO. Each CDR composes 

evaluatioo interval, the kernel performs an evaluation of the ^Z^~^Z,^^oi fields 112 such as the billing account 

pcribrmance of th= anomaly detector. If . performance ^•^''?^~^^^^,cd ^rSfaccouai, 

^,io^iscarxi«do«thcntlKcount«fcrtheniimherof ^^^^^^^^^X^^Atiwcolc^lt^ 

add knowledge events is P"?»"'™*/J^"'J*" FroT^ «t of CDR's tor an individual 

comprises catrytng out a comparison of the candidates and ^^^^ fo, Uiat customer 

any corresponding valideuon results. ^^^^^^ Infotmation from the fields or attributes 112. Each 

Retrain the Nsfural Nelworlc TlTh.~. ni Mimmses several parameteis 113 that are 

lethepetfonnanoe^aluationislesathanttepe^ X^^^fiS^^t^auTftom the individual «t 

threshold, the kernel itritiates rrtramlng of the ueu«l oa- « For e;=mplc. a parameter m^t 

woik. TTte kernel will not icspond to any cyenB that are seiM ^ ^ of local calls made dimng the time period, 

untn retraining is complete. No interyenbon by fte t«nns 5« '^P*«J°'*^„™^,,ted ™traasmission of 

r«l«i^!ddt.Ii^g^etr«ilt^n!^^llel«tI«ltofer^ns4eGUl^^^ ^e^^, ovc? T^rf^ of ih^ pcri«i ^ infonnation 

ISainiD* is cotrplete and wtucb of U>e ?P;«^»^^^^ ^S'to *e ^STof the porfnn in the period For 

1-S above have been peiformed so th« the GUI can upd^e JO ^^»»8 to w ^ ^ ^ pe,oetit-«e of local 

its representations respectively. If an evaluaioon h» t^en ^"^^j^^^^^.^d 8 p.m. on L third day of the 

pkce then the new pcrfcrmanoc evaluation result is sent lo =Jb ^^^^ ^ advanuige that . large mimber of 

the GUI. If the oeural netwoA^be^. retrained. itA^na- ^f^^ ^ s^7afised iaS signaturrs that capture 

lion about this is sent back to the GUI. _ -jsential fcahoes of the pattern of telephone calls made by 

When retraining takes P^'l^^f^^^^^ " S^u^cwwmcis over time. By crcartostwo sisnatures 

cieaed by the kernel, this dwgbttr neural nctwodtbw of time atid oi>e for a shorter period of 

same topology as its parent. Tbe daughter nemalnetworkB ft . ^'capture infotmation both about the 

trained instead of retaining the parent. I!JrSnh«i»a%<attrie)atine to a nartieulir account immbcr and 

Once retrained the daughter neural network .s evaluated 2^^^XZ^^Mu&\> that acconnt number. For 

by the kernel. If the pertarmanos trf the daughter^ be^^r « ^^^^^^ a recent sis«>alurt «b t.c 

than the patxmt then the kernel mdicatw U> the GUI toat a ^J»'=^?^^ hia„r^igoanire reflecting behaviour over 

oew nemal network is avdlable. m GUI asks the user if f^'^^^^XoSByWari^ «^ 

Ssnew ueura) network shouW be used.lbe user's r«po»e «^^^'Z'Xr1i^pt7^^T^^^ ««t^*) 

isscit to thekemclandif affirmative. the Ven«l repU«slbe <^2Lvt^^ t^^tccled. 

parent neural network .»ith the daughter neural =««wo*- « ^i?^" "^^en t^bfaloric and ««cnt signamres are 

>i."^?d^L^S^™=^ Jifr:.^o,ap^arinstantia.ionofaneur.lnetwork 
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0.6 time pcbds for it^ histo^ »«i ^-^^ »^ ^I^ISlIoIvc, selecting tte "WroP^"* 

S«c ha™ been cho«m, fi«d. He d«ib1 CDR (thai aln^ady beea parsed imo tte 

'^s#asH isssiesss?. 

andTl^«wti» c««»Ung from commtuuca- ^.j."^ eJl d-nnbutu«. o«« -eek 

rions nttwoA over lime is iUiisttaled by 13S. Deteanining Whsn a CaU W»s InWated 

to Kralionwh«e a comparison bet*«i« an liBtoite 20 "'i„^^^^clatEpl CDR fbnna shown xnHG-llJbere 

.n?a^nSlu«fc to delect womalies il mjiy "o^omek firfd 171. Itis is iised to dft?"""^' 

SciK^.^ ^ o^t^ "f^^'il^ti^^S^ K tTdetcrmlBc the time Ite cUl was placed cn that 

nc«f Weaniation my be *v»liiblc ^^.fj^^^^^ TOs ia <Joi»e by: 

take this into i<»«uii.'n>esjrstetB most watuntiltheena 01 ^j^.^^ flis calls made eaeh day; 

Se sTi^t period be&te an update « I««W=. ^^liag ihe calls mad* in ead. day/mght p*n«L 

Inorder to ioconnnodale ne* iofonu.hon Obtatod S«e^ time when a call w» initiated has been deter- 

in.^tweea updates a thitd dynamic sigpaime ri ^^^ ^ ^;"ff j,^ Igsibie to cicate Ae elements of the profile 

^rfSiii^ is dynaiiiic because it can be taken over a mmed « i* disribuUon pittan i.c. the uems 

ScTbc lised to trdat* the toceni sigpiitw" bc&tfe the per sp^ percentage of 

frmiTy detection pl«*. IVis h.^ "J^^^"'^^ ^ daSbSt^^iod. (14 i^ms in the prtfflc of HG. li)- 
aU ava^able data is used in the anomjly ^^^^ ^ .dialing to the i*"! «»^°°L^ef^! 

A sianauirc which can also be nsfeaed to as » prowe 8^^^ perceoiagps are based on the number ot 

p«tod of time. In one wwoplo. a pmDle ^^oWQ t» HO- ^ ^ , to 

iTwrnprisca the foUo^/ing major eompon««is. . *° ° le.aJlthepefceniagesawscopedbctweenOandl.For 

flliemsieptesentingthedfatribudonofcallaaisdedwing ^^Ji^; 15% wotiM become 045. 

^ting the profile. frnR¥ile «paraieda^i»M'=«*''y »"*^P"'^'='^i??il<h«^ 

PaLigamtrJwalDi&fcntFormawofCTOr^ !teeanisi»dea<»dsee>*Mchpaiticul»tpenodacjd^^^^^^^ 

This is done by defining aspccificabon for the CDR ss te<SMified in. Potentially. ealJsia»^<»v=ron«d»y«»?»^ 

»2rpa^4ApL*tr»reachtyi«orCDRt5|e^'^ fat^S:" periods (pI Wand 93) j8Sho»«tnna 13^ 

Z a Kbraiy of CDR patseis. A ba« class is created from 2^ ^ . j^e welt and the hour that the call was made aie 

^tr^^ncwtypc'ofCDRi.ableu>inherUa«shownin ^.'J^ T^^n the mmibcr of calls «ade in the tclmnt 

"^Por' each CBR ty,. which . to b^P«- - ^ ^ -^^t^^^rc^^^S^o^'^'^^^^^ 

CDR. An example of a CDR epecfficatwn a *°?^»°iL^- fl^kTUfoenUge nf calls made le mobile telephoo«, 
10 The CDRs are tliCD convened into the des^d formal ?»^P»^ ^ma^ wiUm the profile period and the 

^desired 01 ta*sst call detaU record format ^s shown ,n «^ talccn up with informatioa about calls made 



no. u. 
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Pcrformaxicc Evalnaticm Request (29) Behaviovf Dcscripiioo: A<WXaowkd£6 , ^r.x 

cr,,,^ n^te^^n Pi^ifd riiC^ Upon receiving an AddKaowlcdge event from tbsJ GUI 

Fraud Detection Ri^c.^ (1«) te«5flaior whi^conlains a handk lo a set of candi- 

Po)I lb Recent Profile C«cay (20) ^^^^.^ ^ jl^en ^j^j^^^ an AddKnowI- 

CDR To Profile Tranfoim (13) j 6<igeReqiiest Object (23) with the associated fraud candidate 

on DelAil Record (12) set On complcliou of the request the client will be informed 

Uflvalld*ic(l FiHud Candidates (25) by the AddKnowledgcRcqvest Object (23) what operations 

Fraud Detector SpccLfic^tioa (28) compkted. These opemiions win be detailed by 

rraua lycwwwi ^>i«^uwr.uua ^ cnuxntraiioa parameter with an associated real 

\Widaic Request (8) vbImc, The eoumeratioa lypc contains thts following: 

Candidate Dau Set (15) AddKnowIedgo 

Validated Fraud CandidEitc (22) pcifonmmceEvahiation 

Fraud C^didaifi (11) Rdfaininfi 

Presentation Data Set (17) If nic cnvroeration value "AddKrwwlcdge" ibeo the 

Ptavd CandidAte Data Set pi) ^ a^ociatcd real value will be zero, else it wiU indicate the 

Profile Data Presentation (7) current peifoimancc of the AD£- Thtsc vahwa wiU then b© 

PoU Profile Vector (4) ^ ^ AddKnowlcdgcCompletc event to GUI tcr- 

Rccent Ptofile \fccior (34) b2^^ Description: SwitcbEngino 

Historic Profile Vector (33) Upon receiving a $wiichEngine event firom the GUI 

Fraud Dfcleccioji Client (Z'T terminator the client will intcnosate th© event parameter to 

Description establish if a switch is tcquiced. If 3 switch i& required then 
A reprcscotalion of a client of a fraud detector. This ^ foqucst will be made to the ADE to switch to a new 
conirols the firaud detection aod perfonnaace evaloalion ^j^aiy detector. If a switch is iwt rcquirftd then no request 

requests of the application ^ j^j ^lad© of the ADR On cotDplelion of the switch process the 

C4>4> class name cHcxit will sei^ a SwiichComplctc event to the GUI termi- 



FDFi'audDctcctionQiciiL 



naior. 



Behaviour Description: CteatefraudKemel Kotc: The client is requirwl to control the persistence of 

Upon receiving the CrcateFraudKemel creation event pQnipIetion. 

from the GUI ternainalor, this object will: ^ Behaviour Descriptton: PolTIune 

hnk to the specified friiud detector spedficatjon, object Vpoa. receiving a PoUTime event firooo ibe Process 10 

2S, whidh was passed as a parameter associated with (cJock poU mechanism) terminator which bdicalcs that a 

the creatioa event. detection poU period has been reached. The dient will send 

establish a dodc poUinj; mecbamsm- a DetectionTakin^lact to the GUI tcrnmiator to itxKcate 

Read cusiococr recent aod historical profiles via the per- ^ that tbc cHent camjoi except any events until the operation 

sistence mechanism ( See ji^petjdix B) creating a pro- hais been completed. The client wifl create a fraud detccUon 

fik dau preseotatioa object 7, for each individual requcRt object a<*)^c^i^"°^«>l*«^»*^^*^,P'^^ 

customer and added to the pc cseotatjon data set, object On completion ihe cHcnt will send a DcctionResuItsReady 

Ij ^ event to GUI ternainalor. IWs event includes the tunc stamp 

The set of recent profiles is sent to ooDstnaci poll to reaeni used to create the results file. , . . . , 

^^)V^Z nWKt 20 Note: If the Iscmd is busy when a poll detection pcnod is 

profile decay, object JU. , . , , readied then when the diem becomes available it will get 

A handle neods to be kept on both tl«;Pi^^^ dm ^^',7^^ this time is less Uian the clodc intet^al 

^t, object 17. and p.U to recent F^e decay, ab,ect ^^^^ ^^^^ ^^^^ ^ ^^^^ 

2*'' , the poll detection lias been missed and the kernel seeds a 

When the creation process is ooroplete this object wiU DetectionMissed menage back to the GUI to indicate that a 

send a KemelCrcated event back to the GUItenmnator. a^jtcction has Ijeea missed, 

ITre firaud detcctioa client is now ready to service other ^jfcthptfa 

events. ^ , . . , FDFraudDetcoiionClicnt 

Behaviour Description; UpdatsEvaluatiooinicrval (FDFraudDeteclorSpecificaiioo& fratid_spcc) 

Upon receiving an UptlateEvaluationiaiervai event from lFDFraudDctcct£onaicnt( ) 

ihe GUI terminator the client will modify the FDFraudDetcctionOienf CreaicFraudXcinel 

no_evahiation_period attribute of the Fraud Detector /FDfreudDetecto:Speciflcation& fraud^spec) 

Specification object (28) with the new evaluation interval. v ^ updatcEvaliiatioaittfcrval(Lnt cvahiaiion_jntcival) 

Behaviour Description: UpdateDctedaonStaftDate 35 updateDeteaiDnStartDaie(date detectionjate) 

Upon roceiviDg an Up<lauDetectionSiartDate event ftom ^ ul^tcPBrf6rmanoBThrefihold( 

the GUI iciminator tbc eEent wfll mod^ the de!.ection pcr&rmance.^hreshold) 

Stan attribute of tbc Fraud Detector Spedficahon ob]6Cl (29) . j AddKnowledeeCFDFr audCandidaicDataSeiA data_ 

with tbc new date. Tbc client wUl fbcn atop and update the ^ 

poll cJock mechanism ^^Ith the new dcuctjon lime and so ^(^^ SwitchEjigiix<Bool b-witch_required) 

restart the poll clodt mechanism. ^^-^ Poirnm6( ) 

Behaviour Description: UpdatePcrforroanceThreshold Assumptians 

Upon receiving aii UpdateP-^rfotmanc^Thf^^ ^ ^ ^ specification Object 

from the GUI terminator the cUem wiU modify the ly^^rZl^nd^ci 

evaluadon_perfi?nnaDcc attribute of the Fraud Detector 6s CreatcFraudKerocL 

aSati^n object (28) with tbc new per£6rmance thmsh. The bridge will create fraud candulaie date set cibjcct 

hierarchy on 
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28 



15 



20 



2i 



AdiflCiiciwledge, 

Retraining will alw&ys result in an improved pcrfonnancc 
of the ADE. 

Retraining can follow a reiraixiinB wiihoiui a Switch- 
2o^^ event bohig revived. 
Ownetsliip 

FDFraiidDeteclorSpcctfiwiion 
FDAddKnowIcdgeRw^uest 
FDPravdDct&clionfR&qucs; 
Kcad Acccssors 

RWBooIcail iaAiwnialyI>«t©ctorCnsaIcd( ) const; 
FDPiescntationDataSct* OctPteseinatioi3JC)atflSel( ) const; 
KWBoolcan GetAl>Swtchcd( ) oddsi; 
Write Acccwois 

void SetADSwitcbed(RWBooleAo $tatc); 
Interpret CtU Detail Kecond (IS) 
DescdptioQ . , . . 

The tiaosfonnation that is required in order to iatetpfct a 
commi separated CX>R inio a CDR. 

Note: Not TOiplemented, nbsoibed into Wltjue Request 

Add Knowledgp Request i?3) 
Description 

A leqncst to add knowledge of fra^id candidates. 
C++ class name 

FDAddKnowlcdgcRequesl 
Behaviour Description 

Upon crtatioD the add knoi^edge requtjfit obicct (23) is 
passed a fraud detection data set as a patamet&r. l\ic object 
wiU: 

SeDd& an APPfiAddKncwledgc event to the ADE l^rmi- 
nator inchiding tbc set of example detectioa data 
presentations, object (9)^ contained within the specified 
data set. Tbese should only incluidc tboee account 
which have been validated (For more infonnatiocn see 
"Enuinci^iion Types" oo page 53.). 

UpOD completion the AX>£ generates an 
APPWKDOv^cd^eAclded, wjiieh conuins a handle to 
the new Jmowledge set- Tbi£ objea roust persist this 
informatioD using tbi n6w_knowledge_fileiiame. 

create a update historic profile request, object 24, oltach- 
iog ib& specified dati set. 

chedt if aperfofmanoc i^wlalc is required by interrofi^iing 
the performance evaluailoD counter attribute of the as 
fraud detection clicui; object C27), and dotenmning if it 
equals the number cf cvahiations ^jcctfled contained 
within the fraud detector specificaiiofl> object (28).. If a 
performanoc updaie is required then a performance 
evaluation request is created and the performance 
cvshiatiOQ counter attribute is reset to aero. If a per- 
formance updaie is not required then the perforniaoce 
evahxatioa counter attribute is faiaemented. 

The operadon enumeration is set to "AddKnowledgc* as 
default 
Methods 

FDAddKnowledgeRequcst( 
FDFraudCandidatoDataS«l& fraud Jaia^set, 
String new _Jcnowledgc_illcname) 
-roAddKnowledgcR6quest( ) 
Assumptions 

Update Historic Profile Request (24) will always be actioned 

after an Add Knowledge Requcist (23). 
Ow&emh^) 

FDUpdateHistRcquest 
FDPcrjEonnanceEvahiationRcqucsl 
Read Accessors 



Ko public read access methods me required by the object. 
Write Accessois 

No public write acoess methods are required by the object 
Update Historic Prafde Request (24) 
Description 

A request to update historic profiles. 
C-H- class name 
FDUpdaieHistRequcst 
Behaviour Description 

Upon creation the Update historic profile request is passed a 
fraud detectioa data set as a parameter. This object wiU: 
Sends an APPTUpdaieHistoricProfilcs event to the ADE 
tormupator indudiog the set of pioSXc dau presenta- 
tions. Only those validated fraud candidates with a 
validation category of citber oocrect Don-fraudulent or 
iijconccl fraud candidates, lo addition all the other 
non-fraud candidates are passed to the AD£. 
Upon completion the ADE gcnccaies an 
APPJSProfilesUpdated, the event contains the updated 
profiles- The update historic profiles request then^ needs 
to persist all ttie updated historical profiles. This data 
set can tttcn be removed- 
Methods 

FDUpdaicHi5tRequest< 
FDFraudCaiK)idatePataSec& fraud^data^jsct. 
String historic jrofile^^flleiiame) 
.4i:)UpdateHistRcqucKt( ) 
Assumptions 
None. 
Ownership 
Read Accessois 

No public read access methods arc required by the objecL 
Write Accessors 

No public write access methods are required hy the ol^ect 
Perfhrmancc Evaluation Request (29) 
Description 

A request to evaluate the performance of the 6aud detector 

applicatioo, 
C++ class name 

FDPerforaaaaoeEvaluatioaRcqucsl 
Behaviour Description 

No parameters are sent on construction of this object. This 
object wilh 

Sends an APP3EvaluatePcrformaru» event to the ADE. 
Upon completion the ADE generates an 
APPllPeifiormanceResultsObtained event with ihe 
ADE current performancB. 
If the resulting perfiarmancc evaluation Is less than the 
evaluation threshold attribute of the fraud detector 
sped^oation then the performance evaluation request 
sends an APP4TrainAD event to the APE. Upon 
completion the ADfi generates an 
APn2AnomjayDeteetorl^arDcd with the a new per- 
formance tovn the AX>E. 
The operation cuumcrdlion type object attribute of the add 
Imowledgp request needs to be set to either "Perfior- 
roanceEvahiation" or ''Kclraining" to indicate which 
operation has been performed, 
The new performance is returned to the add koowJcdge 
reque^ object. 
Methods 

FDPcrfDrmaoceBvaluationRcque5l( ) 
-FDPeifrttfflaDceEvaluationRequesl( ) 
6S A&Fiumptions 
None. 
Ownership 
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Read Accc5sors 

No public read access methods are required by ih^ o\^tct. 
Write Acccssois 

No public write acoe:&& tncthods arc required by tbo object 

Fraud I>ctcclioii Request (.15) 

Desdiptioa 

Arcqvest to perform a dctecdon of firaud oa aprc^eiitatiOD 
data set. Hie rcsultaDS &aud candidates are contained io ihz 
assod&ccd candidate data ^t. 
C4-'«- class name 
FDFraudDcteciionRBquest 
Behavigur Description 

t^n creation the fraud detection request is passed a 
presentation dau set as a parameter. This object will: 
Oeatcs CDR to profile tranfoiTO, object 13, with csv 

ftlenamc and poll detsctioa period. 
CDR to profile tranfoim, object 13, returns a list of poU 

detection proaies^ objocl 4. 
Creates fraud cwdidalc. object W, to be populated with 

the results fcom the ADE. 
Sends an APP2PeffonnI?cicctxoa event to the ADB 
(enninator, with pralile data presentations, object 7, 
whcic ttic profile modified attribute is true. 
Once the ADE has completed the detection event the AD2 
generates an AFPKfftetectionConiplcie. The fraud 
candidate, object 11 is populated with candidate 
presentations, object tnaiching with the associated 
recent profile^ object 4. 



No public read access methods arc required by the object. 
Write Aooessois 

No public write access methods are requited by the object 
Poll lb Recent Itofile Decay (20) 
5 Description 

The decay tiansforoi £or decaying a poU pcdod profile into 
a recent profile, 
class nacne 
FDFoIllbReoeutPtofileDecay 
10 Behaviour Descr^don 

Upon creatloD this object is given recent profile vectors 
object (4). This object will: 
Create relationships to all xeoent profiles. 
Calculate update fiictor using poll detection period fiir 

source and recent profile period for target 
Upon a DecayProfilc event search for tbc corrc^ondit^ 
recent profile. If no recent profile ejcists create new 
reccgt profile. 

Update the laigct profiles behaviour with the source target 

behaviour using the algorithm below. 
Once tbc recent profile has been updaied the poll detec- 
tion profile can be removed. 
Modifies tho profile modified attribute within the assod- 
ftted profile data presentation, objea 7. to true. 
Methods 

FDPoinbReccntProfileDecay( 

RWTPtrDlist^<jFDReccatProfilcVcctor>& rcccnt_p«)file, 
Trnae poll_deleCtion_pciiod, 
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The profile modified attribute within profile data 30 Time recent^tofilejeriod) 
presentation, c^ject '7, fijr ajl those sent to the ADE " ' '"''^ 

terminator need to be set back to false. 
The fi^d candidate, object 11, pcisistenoe mechanism to 
write the results to ii file. The time stamp at time of 
oeatioQ of this file n^^eds to added to the top of the file 
and maintained to be sent back to the client, object 27. 
Once the results file har. been created tbc &aud candidate, 
object U, can be removed. 
CDR ExtractiOT, Poll Prolile Cmatian and Search Algorithm 
while(noi cnd_ol_fiJe) 

Read<ncxt_Une_of_^) 
cdr"CreateCDR(ne3dJiine_of_lile) 
i£(account_^o! -cdr.accouuL-ttO) 
po11,3 profilc«OreatePoUl'rofile(cdr) 
else 

poIL-profile=Ai!CumulatcPoUProfilc(cdr) 
accouni_DO=cdr.account^jio 
r)ccayRecent(pon_profiH) 
DeJetePOllPlofile(polUpfofile) 

Note: Assumption that the CDR file is sorted by account 
number. Decay profile will provide a biuary seardi tech- 
nique to locate the receot profile* 

Methods 

PDFraudDeicctiooRequest( 
FDPresenlationDataSet& preaentati0D.^4ata_sct 
FDPoirJbRecBntPro£aeDBcay& p^ofik^decay 
Striog t«snIts_JGi]enamer 
String csv^lename 
Time polL_detection_pcriod 
Time recent_profile^period) 
-FDFraudDetcetionRequest( ) 
Assumptions 
None, 
Ownership 
Read Acoessofs 



-FDPoirroReccntPromeDecayC ) 
void DccayProfilc(FDProfileVccior& polL_profiIe) 
Assumptions 
None. 

Updating profiles algoriUun 

For all i Where T is the target profile (e.g. rcoenl profile) and 
S is the source profile (e.g. poll detection period profile^ 
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Read Aooessors 

No public read access methods are rtsquircd by the passive 

object. 
Write Aooessors 

No public write access methods are required by the passive 
object 

CDR To Profile Tranform (13) 
Description 

A request to perform a detection of fraud on a presentation 
daU set. Hie reuuliam fraiai candidates are contained in 
tt^ associated candidate data seL 
C4-1- class name 
FDCDRProfileTraofonn 
Behaviour Description 
Upon crcalioD CDR profile transform, this object wi0: 
For each call detail record, object 12, this object either 
consimcis a poll profile, object 4^ or updates the 
existing poll profile. 
This object sends tbc poll detection profile to poll to 
recent profile decay, object 20. with poU detection 
period and recent profile period. 
Methods 

FDCDRPrDfileTranfi5nn( 
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String csv_Jilcnam«, 
ini poJJ_detfictioD_pcriod) 
-FDCDRPrafilcli^nforniC ) 

Operates on ao ordered input file. 
Owoccship 

FDProfilc Vector (PoU ddcciion profiles only). 
Read Acccssofs 

No public read access mctUcids one required by ttie passive 

object. 
Write Aoccssois 

No public write access mciiods aw rc<juiicd by the passive 

object 
Call Detail Record (12) 
DescnptjoD 

A software rcpiesci^tatioa of a tckooizianmication c«tl detail 

record. 
Ct+ ckse name 
FDCalUHuilReoord 
Mctbods 

FDCalIt>et&ilRecofd(Stiiitj; csv Jlenamc) 
-Ft>CaUDeuiIRccoid( ) 
FDCaUDetailRecoid Rc&dCaIlI>etaiIReconl( ) 
AssumptiOilXS 

The source CDR file is ofdercd by account number. 
Ownership 
Rejid Accessofs 
Write Acccssois 

Uovalidated Fraud Candidates (25) 
Description 

An unvalidaied association of a customers recent profile 
the results of a detectioa process, 
dass name 
PDUnvalidatcdFrBudOnKlidatce 
Itlhcritaoce 
FDFraudCaodidatc 
Methods 

FDUavalid&(edFr2UdCaQdidates( 
FDPxofilcVfectorft rcccDt_4irofile, 
ADCandidatePreaentatiODi candidate_prc6cnta.tion) 
~FD'UiivalSdatedFnmdCaTididates( ) 
Assumptions 
None. 
Ownership 
None. 
. Read Acccs60x« 
No public read access m^ithods aic lequired by Ut» passive 

object 
Wriia AcoepaofS 

No public write access meihods arc requited by the passive 
object 

Fraud )OetectQr Spcdficaiion (28) 
Dc^iciiptioa 

The specification of the linaud detector application. 
C+-I- class name 
FDFraudDe le ctorSpocificatLon 
Metimds 

FDFraudDcU:ctorSp©cifecation(String DBlaulLJCSu3ts_ 

filcnaiBc 
String cfiv_^nanw: 
String ECccnt_jtfofile_fiJcoame 
String hwin ricAl profile ^filename 
Siring »[ie^^,^poc_j51cnaoc 
Date dfitection^tari 
int cvahMit»D_intcrval 
ini cvaluatica— ecfunter 
int perform aiice_tlircshold 



lot rcccut_window_„sizB 
TDt hisioriciL-windoiw^jizc 
int detcciion^tinjc_intcrvaI 
int input_5itc 
5 ml receoL-^ize) 

-FDFraudDctcctorSpeci£k:ation( ) 
Assumpibns 
Ncbe. 

Ownership 
10 None. 

Read Accessors 

StringGetDcfsuJtRe&'UltsFilciiamBC 
d€faull_rcsultSu-filename) 
String GetCSVPilciiame(csv_^CTiainB) 
String GctRccejitPrtifileFl]eDame{ 
recent prafile_^fiIenaiDe) 
Strmg GetHistoricalPECifileFilcname( 
h2StoricaLj>tofile_Jilcnamc) 
String GetAD£i$pecFilename (ade_^peq_^eDune 
20 E>al& GetDeicctionSLArt(detecdon_start) 
int GetEvalnationlntfirval(evahiation^tcrv»I) 
int GeiEvaltiationCounteEi[evalualio<D__a3iiiitef) 
int GetPerfouDanc&'nircsboId(pefformance_threslioId) 
int GctHffilodcd^odowSize(historicaL_window_;5izB) 
25 iijt GetRcc«itWlDdDwSize(r60crt_windaw_^B) 
int OctDctcctionTinich)texval(detcctwnL_liine_JiiKivaI) 
int GetinputSizc(inpiit_$i2e) . 
int GetReoentSiafi("^t_si2e) 
Write A^oesaoiS 
30 void SetDcfaultReSUltsFiJ.enaiiie(String dcfault_result?i_ 
filename) 

void SctCSVKlename(StriDg C5v_^filename) 
void SciRecentPH)fileFilenamc(String fecent_proflle_ 
liicname) 

35 void SBlHistorica.lPro£IleFilcDainc(String bistorical_ 
profile^tcname) 
void SetADESpecFilename (String ade_q>ec__filenainc 
void SetDet&ctioD$ta:i(Date dccection^tart) 
void SetEvahiaiianialervaKiEt cvaluation_Jnterval) 
40 void SctEvaluationOountcT(int evaJuation^couiitcr) 

void SetPecft>EmaiK»Thtesbold(int p<rf6rm*ncB_lhresibold) 
void SctHistoricalWindowSize(int historicaL-Window_ 
size) 

void SetIleceiitWindowSizc(int rcocnt_wiodow_^e) 
4j void SclDetcctiooTimelnterval(tttt deteciion_timc_ 
interval) 

void SetInputSize(iat inpui^^size) 
void SetRccentSizc<mt leoent^ize) 
Validate Reqw^ (S) 
50 Description 

A request to create a validated set of fraud canoMaies, 
Note: Not implemented, absorbed into Fraud Detection 

Request (1^. 
Candidate Data Set (IS) 
$5 Descriptioii 

A set of candidate presentations. 
Ohf class name 
I'OCandidateDataSet 
Methods 
60 FDCandidaieDataSci( 

RWrPtrDlist<tADCandidatePfescntatjon> 

Acandidaic jresentation_ids) 
-FDCandldatcDataSel( ) 
Asmmptions 
cs Ownersbip 
Read AcccssoiB 

int GctNumberO£Preseatatian5( ) const; 
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Write Acc&sscKS 

void SctNumbe rOfPrcr.cn laiioas{itii number^of^ 

presentations); 
Validated Fraud Candidaic (22) 
DescnptioQ 

Ao association Of a custonxcra cecem profile and the vali- 
dated results of a detectioa process 
C++ class naoie 
FDValidatcdFtaudCandidaie 
laheritaDcc 
FPFraudCandidate 
Methods 

FDWidatcdFrandOuididar^ 

FDPlpfileVectOfA icceatjfofile, 

NNExa2npleDauPrc9caUlion& exampk—piedentation); 

-FOValidatedFcaudCaoaidatc( ) 

Emimef ation Types 

enum ValidatjbnStitus 

{ 

CORRECT JPRAUD, 
INCORRECT JFRAUD, 
CORRECT-NONFRAUD, 
INCORR£CT_J^ON_JKAUD 

} . 
AssiuQptioas 

None 

Read Accessors 

VaKdaiioDStatus GetWiiaiooCatcgoty( ) const; 
"Wnte Accessois 

void SctValidationCatcgoiy(VaHdationStatus 

validatiofl^catcgoiy); 

FniUd Candidate (U) 

Dcscriptioii 

An association of a customers recent profile and the results 
of a deiccrioD process, (either validated or unvalidated). 
C++ class name 
FPFnudCdodidatc 
Meibods 

FDFraudCaiididate(FDProfikVecior& rtc^ni^ofilt) 

-EDFrftwJCaadidatc( ) 

A^mptioas 

OwnershTp 

Read Accessors 

No public read access me thods arc required Uy tl» passive 

object. 
Write Accessor^ 

No public write access cn stbods required by the passive 
objea 

Presentation Data Set (17) 
Dcscnption 

A set of profile data pre&tatations. 
€+•>- class name 
FDFrescntatianDataSet 
Methods 

FDPresentationDataSet(FDProfilfiDaUPt;esentation& 

profile_datii^pfesenlation_Jd) 

FDPrefieaiationOataSct( 

RWTPtrDli5t<FDProfiler)alaPresenlatioD>& 

profilc_data^resenlaiie n^ids) 

-FDFrcseniafionOataSeH^ ) 

Assua3ptioQ±» 

Ownership 

Read Accessors 

ini GctNumbcrOfPfcsenlatianfi( ) const; 
Write Accessors 



void SetNumberOfFrescatations(iot Dumber_of_ 

presentations); 
Fr>vd Candidate Data Set (21) 
Description 
5 A container of liaud candidates. 
C++ class name 
FDFraudCandidateDalaSet 
Methods 

FDFr&ydCaiididateDaiaSec( ) 
10 '*FDFracdCaadidalcOataSct( ) 
Assumptions 
Ownersbip 
Read Accessors 

int GetNuiDberOfPit»sentation£( ) const; 
Write A^scBssors 

void S6iNuD3betO£Prcsenutioas(!Dt Diiniber_of_ 

presqQialiofls); 
Profile Data Prcscniation (7) 
Description 

Cbmbiiiatioii of a hascoric and a ceceoc projEUc dau vector. 
C++ class name 
FDFrofileDataPreseatation 
Be haviour Dcsctqjtion 

Each recent profile is matched with it respective historical 
profiles and sent to the ADE. This representation is used 
for both <Jeiectioa (object Ifi) and profile decay (object 
24). 
Metbods 

FDPcofileDataPresentatioD( 
FDPrDfile\fectorA. receatjrofile, 
FDProfile'V^ctor historicaL^cofile) 
FDPlofileDataPtcs6ntation( 
FI>Profiic\fector& reociUjioftle, 
RWTPtrDlisl<FDFrofile\fector>& hislorical_profile) 
-FDProfileDataPresentadon( ) 
AssumptioDS 
None, 
Ownetship 
Rend AcoessQxs 
40 Bool GetProfilcMadified( ) const; 
Write Aoocssors 

void SftiPfofilcModificdCBool proffl©_jnodificd); 

Poll Profile Vector (4) 

Description 

M Describes the structure of a profile dat& vector 

C++ dass name 

FDPoUFrofileVfcctor 

Inheritance 

NNVoctor 
50 Methods 

FDPollProfile\fector(S£ring aiocount.jiujnb<r> 

FDCalIDetailRecciT<l& calLJ*=iaiL-rccord) 

-PDPollProfilcVecior( ) 

AssuTTiptioas 
5S Ownership 

Kcad Accessors 

String GctADOonolNurober( ) const; 
Wdte AccBssofs 

void SetAccountNumber(Strio$ account^oumber); 
60 Recent Profile Vector (34) 
Description 

Describes the stnicinre of a recent profile data vector. 
C++ class name 
FDRecentPi^ofileVsctor 
65 labcritBnce 

ADRecentProfilc Vector 
BebaviOTlf Description 
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Ader the pel! priTfiles bave been used to update the ceccot 
pc^fik^ ibe updalc<l recent profiles theo occd$ to be 
persisted to the rcccDi profilt file using the pcrsbtencc 
BsechajQisno. 
Methods 

FDRcccirtPtofileV€a:to]c(Sti:jig acoounL-Oumbcr, 

NNVcclorife data^vector) 

-FDReceatPfofileVcctar( ) 

Peis»l($*iing rt;C6m^j«ofilc_Jllcnaine) 

Assucxiptians 

Owoerfibip 

Read Acx:c^rs 

Suing GctA£^tu)tNumbcr( ) oonstj 
Write Acccssois 

void 5ctAccoiintNaiiit>ex(StriDe acoQunt_0iimbei); 

Historic Profile Vbcior (33) 

Description 

Describes the structure of a piofile data vcotor. 

0+4- ctoss name 

FDHiiiloricProialcVcctor 

lohcritwce 

ADHistoriealProfilcVector 
Methods 

FDHi5todcProfileVector(SniiTtg acoounLJXwnbcr, 

N>IVectDr& data^vcctgr) 

-FDHistoricPiofilc\tector( ) 

Assuixiptiot» 

OwDciShip 

Read Accessory 

String GetAccountNunibei^ ) cons^ 
Write Accessors 

void SciAccouflibfumbcTCJtring accountw-numbex); 
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Appendix; B: 

Persistence 35 
Overview 

ToolsA-M- vcjsioa 7.0 Users Guide, 1996, Wave 
Software, defines that & object can have one of four levels of 
pcxsisteoce: 

No pcisisicDce. There is no mecbamsn) lor storage and 
retrieval of the ol^ecL 

Simple pcreiatenc*. A level of petsistcnoe that provides 
sloxage and retrieval of individual objects to and liota 
a stream or file. Simple pefSistCDce do^ not preserve 
poioier iclationsbips amoDg the petsistcd ot)jec(&. 

Isomoiphic pexsisteace. A level of persistence thai pre- 
serves tbe pointer rulatioasihips eunong the pcisisted 
objects. 

Polyniorphic pcTsistfiQC«. The highest levcj of perSEStencc, 
Polymorphic persistence preserves poiater relation- so ^^l^^i^^i^ oto 
ships among the persisted objects and allows the rcslor- * ^4 » t>to 

ing process to restoic an object without prior knowl- 
edge of that objed's type. 
This appendix provkk* infiormatiOQ about the use of 
Isomorphic pcisisteoce through descriptjons, examples, and 5S 
pioccdutcs for desigmng persistent classes. To implement 
other levels of persistence it is recommended thai the reader 
consult the lelpvant Hx>Ls.h++ manual pages. 
Pcntifttence Mechanism 

Isomorphic persistence is ibe storage and retrieval of w 
objects to and from a stream such that the pointer relation- 
ships between the objects are preserved. If there aps no 
pointer relauooehips, isomorpliic persistence cfiwrtivcly 
saves and restores objcds the same way as simple persis- 
tence. When a oollcciioa is isosnoiphically persisted, all 65 
objects within that coUcction arc assumed to have ihe same 
type. 



The isomorptlic peTsistenoe mechaolsm uses a tabk to 
keep track of pointers it has saved. When the isomorphic 
persistence mechanisiD eaoouoiers a pointer to an unsaved 
object, it copies the object data» saves ih&t ot>ject data NOT 
dje pointer lo the Stream, then keeps tracfc of the pointer in 
the save tabic. If the isomorphic persisicnce mechanism later 
encounters a pointer to the same object, instead of copying 
and saving the object data, the mechanism saves tbc save 
table's reference to the pointer. 

When tbc isomorphic pcjsisienoc mcchanistn restores 
pointers to objects from the stream, the mechanism uses a 
restore tabic to reverse the process. When tbc isomorphic 
persistcQoe niecfaaoism encounters a pointer to an uj^restcred 
otjoct, it recreates the object with data from the stream, then 
changes the restored pointer to podni to the recreated object. 
3^ The mcdunism kcc^ track of the pointer ia the restore 
tabic. If the xsomoirphie persistence mecbanisin later encoun- 
tcis a icfiercooe to an already-restored pointer then the 
(ziBchanism looks up the reference in the restore ublc, and 
updates tbc restored pointer to point to the object referred to 
20 in the Cable. 

Class Requirements For Persisteocc 

Tb create a cbss (hat supports isomorphic persistence the 
class most meet the foUcwuig requirements. 
The class roust have appropriate de&ult and copy con- 
structors defined or geoeiated by the compiler: 
PClass( ); //default constructor 
PClassCr& t);//copy oonstmclur 
The dass must lu^vt ao assignmient operator defined as a 
member OR us a gjbbal function: 
PClaffi& operatorKconst PClassA pc);//mcmbcr function 
PClas&& opcrator--(PCla5s& Ihs, const PQassA rhs);// 
global 6u)ct3oa 

The dass cannot have any rxm-iype template parameters. 
f>oi example^ in RWTBit\fec<size>, *'sizc" is place- 
holder for a value rather than a vypa. No present 
compiler accepts fanaion templalcs with non^tyi^c 
template paranietcrS, and the global functions used to 
implement isomorphic persistence (rwRestoreCSuis and 
RWSavoGuts) are function templates when they arc 
used to persist templatixed dasscs. 
All the data necessary lo recreate an instance of the class 
must be globally available (have accessor functions)- 
Creatilug a Persistent Oass 
To create an isomorphicaJly persistant dass or to add 
-45 isomorphic persistence to an existing dass* follow these 
steps: 

1. Make all necessary class data available. 

2. Add RWDECCARE—PERSISTABLE to yotir header 
file.' 
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RWDECIJU;OEJPKRSISTABLE(Youraas$) 

3. Add RWDEFINE_PERS1STABLE to one source file. 
^Ddude<rw/epeisifit.h> 
RWpeFINE_JERSISTABUE(yourClass) 

4, Define nvSaveGtits and rwRcstoreGuts. Methods 
rwSftvcGiils and rwRestorcGuts will be used to save and 
restore Ihe intetnal state of the class. These methods are 
called by the operators and opcrator» that were 
declared and defined by the macros in 2 & 3. 
For noD-templaiizcd classes, define the following ftinc- 

void fwSavcGutsOWFilfiA f, const YourQassft t){r_*/} 
void rsvSavcGul»(RWvostream& s, const Youraass& l) 
{/*_•} 

void rwRc!itoreGut5(RWFile& t YourOassA t) 
void rwRcstoieGuls(RWvistrearo& s, YouiClass& t) 
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Tqt t£mplati2ed classes with a susgle template parameter 
define the following fimctioss: 
tcmplate<cIasA T>vQid 

rvSaveGutfi(RWFi3e& f, const Yoiiraass<iT>& t){/*^V} 
templaie<clas5 T>void 

nvS«vcGuts(RWVostf«aflQ& s, ooost YouiCb5S^>A i) 
tcaiplatc<dlas3 T>void 

rwResto»Guis(KVVPUe& f, Yoiiraas5<T>A t) {r—V} 
templatc<class T>vaid 

rwR65tDiBGiits(RWVistfcaiD& a, YoiirClass<1vA t) {/*_ 
*^ 

Fbr tempi &tized cla£se& with moic than one template 
parameter, define iwRestoi?eGiita and twSaveGuls with the 
eppropciHte number of tdTzplate ^rainetei^ 

FoDCtion ovSaveGnts saves the state of each eU^ mem- 
ber occcSMty persistence to ^ RWvostceam or an RWFilc. 
If the mcmbecs of your class can be pers^ed and if the 
necessary dass membcts are accessiblo to n^SaveGuts, you 
can use operfttorx< lo 6^v*i tbe class members. 

Functinii rwRcstoicGots restores the state of each class 
member necessary fot persistence from an RWyistrcaia or 
an RWFite* Provided that the membeis of your dass arc 
types that can be peisittted, and provided ibat tbe mcmbccs 
of your class arc accessible to rwRe^feOuLs, you can me 
operators to icstoie the class mcmbei^ 
Example of a Pex^istent Class 
PCUss Header Hie 
#inclnde-ctw/C3lxing.li> 
#iDcbide<iw/edefsJD> 
#inclnde<rv/rvfile.b> 
#include<rw/cprraistJi* 



{ 

pub] in; 

PCtut 0; 

PCUss (00 ut K^CStriTi^ 8triTig_ptTrihma, 
//PenbOaBiec OpotViion 

&iBiid void rvi^Bacton;C'utaCtnVVi«trcam& FClw«j^ obj); 
fnaai void ywK£sta»ChiIsCF?vrLle& Ble, POam^ 0>j); 
friend void TvSaveOiim(RWVostccaiJi& as, coast fCtensA obj); 
ftiefld \-oid iwSaw<Hit5(JlWPiIi:& We, coma FCLuaA obj); 
//Stream oparsitOttS 

Mend oatfEuaf^ Dpen(or«<oBtitAtt4% 03» cout FClas8& cl>j); 
privaoe: 

RWCStriog StrinsAitxCbUtc; 
iai [otAiinbtitc; 
dMt FloatAttribvt«; 
PCto333- Pt/rtsAttributo; 



38 

-contiQucd 



PtiTbArl/itwU - ptr_ta_(iUnbttlo: 
5 PCtiEs::r»I»aafl«0 

j 

KWDEnNE_PERSlST>3t,E(PaBB) 

10 U>^;'StriagAUribatet //Scitani Suotg. 

U»0bi JptAdnbulc; //Rc<texa tnL 

£s»«bjJloacAUxibUlc; //Rc^on PlottL 
RWBoole&n ptr, 
is»ptz; 
if (f«) 

^ ap^j.PtfrbAllribalB; 



Ilwdec 



ECLAR£JEBSISTABLE<PClMs) 



( 



} 



iLtActnbate - 0; 
FlortAuzOiuic ■ 0; 
Ft/I^tAitribate ■ 0; 



PClaBS* pW_t«LJ»ttribTilo) 



> 



} 



TOjd TwRealoioGutaCRWFUei fH^ POaSf* 0>j) 

^ fflBXKjbJ.SlrinRAtttihuta; //RwtOK Siril^s. 

filo»ot^.tntAt!ribtie; //ItcMore tcL 

aiB»abjMlMLAXtribuie; //Restore Float. 
RWBoolcaii ptr, 

if (plr) 



> 



filo»0bj^UTWttnbntD; 



vaid fWSavcCTnts^V08tfcara& n»» const FGtft»& o^j) 

^ os«so^j^tnnsACUibrtue; //Savo String 
30 o»4^M-^i^'^^'^^ //Slave liiL 

65-<4»ob3.FoatAltnbOt6; f/Ssva FlOit. 
if (obj.Pti'IbAttriblittiMrwrfl) 

lft<^A]USE; /^ poiltef. 

} 

33 bIso 

ai«TRU£; //Save FaintDi 

08«*(dl^'.PliTbAttnbute); 



> 



void /wSftvtQctsCBWFiltjA fUe^ cDoost PaM«A obj) 



filo-c-cobj.StriflSAttxibcte; //Save StrinB- 
file«obi.talAtHibulo; H/Sove InL 

file^Vf.PleaiAOzftwtD; //Save Float 
if (oh] JitOhAUribotft-^wnil) 



4S 



{ 



//Ho pobiisT. 



} 

Clcc-OTUE; //Sbw Poonser 

filo«* (obp^tiTbAiinlMnc); 

eautftfliA c>pBmtor<«(o8treflTn4 as, ooMt PCfau=& obO 

os<4^''nmtAunbiit«*' 
• «D^'.FlcwtAtrn>Ut&«^ "> 
oa^WTiAttribiilor 
«(v6ia')o*j.PtfniAiiiibut*«<r' 
^ ijf(c^JuTsAUnbutB> 

cs<^^%lue at Pointer:" 



S5 UBoofPCbw 

#i2tduee <h»tram±> 



PAGE 8(14 ' RCVD AT S/4/2004 7:42:i$ PM [Eastern DayOght Time] ' SVR:USPTO{FXRF-1iO ' DNIS:872930$ ' CSID:617 832 7000 * DURATION (m^$)m 



05/04/2094 19:45 617-832-7000 FOLEY HOAG LLP PAGE 09/14 



6,067^35 



39 
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vQtid aniaO 

//Creole objed th&S wUl be pciuiiDd W by 
//jpcifb^ent object. 

H^CStciDg llCpCOlfL_p<rinlnr__pbjecOl 
KWCSlriflg ft2(-pa5isL_da£s3-); 

POttM pwsirt-J=lBsilCa2, 2, &porsfaL_poittter_iobjci*); 
coul^<^IBi«-_<)™tl (before iave)r<*eadl 

//SovE object b flk ^eaUiaf \ 

FCtflfls penicc_dttK92: 
//J<eAO« objecL bom flk "testdat**. 



10 



} 



c<pflBLKL_clasr2«eitdl<««ciUD: 
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Special Caitt with l^cnostcnoe 

ThQ pexsistence mechanism is a useful quality, but 
rcqidiBs care in some areas. Here axe a few things to bok out 
for when using persist dai^s. 

1, Always Save an OV)M by Value before Saving the 
Identical Object by Mntrr. 

In the case of both isoiDOiphic and polymorphic perais- 
tcnm of objects, never stream oui an object by pointer before 
streaming o^ the identical object by vahie. Whenever 
designing a class that conrAins a value and a pointer to that 
value, the savcGuts and restoreGuts member functions for 
thai r*"*^** should always £4iv© or restore the value then the 
pointier. 

2. Don't Save Distinct Ohgccts with the Same Address. 
Be careful not to isomoiphically save disdnd objects thai 

may have the same itddress. The iotenial tables that arc used 
in isomoiphic and polymorphic persistence use the address 
of an object to determii^ whether or not an object has 40 
aheady been saved, 

3< Dod'i Use Sorted RWCoUections to Store Heterogeneous 
RWConectabUs. 

When you have more than one diffcienl typ« of RWCol- 
lectable stored in an RWOoUcclion, you can*t use a sorted <S 
RWCoUectioo. For examijle, this means that if you plan to 
store RWCoUectablcStrinfis and RWColleaableDaies in ihc 
same RWCbUectiou, you can't store them io a sorted RWC- 
ollectioo such as RWBtrwe. The sorted RWColledions are 
RWBinaryTree, RWBtree, RWBTreeDictionary. and 
RWSorled\'%ctor. The rejison for this resuicdon is that the 
comparison functions Cot sorted KWCoUccdons expect that 
the objects to be compapjd will have the same type. 
4. Define All RWCollecllblcs That Will Be Restored. 

These doclaraiioQS are of particular concern when you 
save an RWCollectable iii a collection, then attempt to take 
advantage of polymorphic persistence by restoring the col- 
lecdOD in a different program, without using the RWCol- 
lectable that vDu saved. IF you don't dcdaic the appropriate 
variables, during the restore attempt the RWFactory will 
throw an RW_MOCRE»Lre exception for some RWCol- 
lectable class ID that you know exists. The RWFactoiy 
won't throw an RWJIOCREATE cxccvption T^ben yon 
declare variables of all the RWCoUectables that conld be 
polymorphieally restored. 

Tbc problem occurs Itccause the oompUcr's Ueker only 
links the code that RWfactory needs to crcahs the missing 
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RWCollectable when that RWCollectable is spedficoUy 
mentioned in your code. Declaring the missing RWCol- 
lectables gives the linker the inJbnnatioii ii nocdb to link the 
appropriate code needed by RWFactoiy. 
Whit is claimed is: 

1. A mcltod of managing the proocs^ng of informatum 
Tifii'rtg^ 0 €u[9t neural netwodc, the inibnnadon relating to tbc 
transmission of messages in a telccomrounications network, 
the method comrprising the steps ot 

(t) monitoring the performance of the first neural network 
in processuig the information; 

QI) creating a second neural network of the same topolopQr 
as the &5t when a predetezrouicd performaooe thresh- 
old is reached, and 

(iiO retraining the second neural network while contirm- 
ing to process the information using the fizst neural 
network. 

2. A method as ciaimcd in chim 1 which further com- 
prises the step of oompaiing tbc firet and second neural 
networks and repladbg the first neural network with the 
second neucal network according to the result of the com- 
parison. 

3. The method of ftinim l wherein the neural networks 
comprise an arrangement of units and a set of wei^ts, 
wherein the neural neiwoiks have the same arrangement of 
unjLs and, before rtiraining, have the same set of wei^ts. 

4. The method of claim 1 wherein the steps of creating and 
retraining the second neural rustwotk arc earned out auto- 
matically, 

5. Tbc method of claim 1 fiurthcr comprising the steps o£ 

(i) inputting a series of inputs to the first neural netwnric 
so as to obtain a oeries of corresponding outputs; 

(ii) JnpuUing a set of target output values ooiTcspondir(g io 
1 subset of the outputs; 

(iii) generating set of training data which comprises 
Infonnalioii about the target ou^ values for use in 
retraining the second neural net 

6. The method of dairo 1 wherein the pcrfoccDafice 
moniioriiig sterp comprises tbc steps ofi 

00 inputting a series of inputs to the neural netwodt so as 
to obtair> a series of corresponding output^ 

(ii) inputting a set of target outpul values corresponding to 
a subset of tht> outputs; and 

(iii) comparing the output values With iheic re^MSctivc 
target output values to produce a vahie indicative of the 
accuracy of the output values. 

7. A method as ciaimcd in claim 6 in whidi the step of 
obtaining a set of conesponding target output values com- 
prises di^Uying information about the outputs using a user 
interface and accepting target output values using the user 
interface, 

S. The method of claim 1 wbcrein at least the second 
neural network is implementod using at least one instanti- 
ated object treated using an object oriented programnihis 
language and the method further coropriECs the steps of; 
ooflvening the cibjcct into a data structure; 
storing the data strpciure; and 
recr^ling the object from the data structure. 

9. A method of processing intomation relating to the 
transmissioa of messages in a lelecomiminications nccworic, 
the method com^i^g the steps of: 

(i) processing the information using a fifst neural network; 
and 

(ii) managing the processing using the method of claim 1- 

10. The method of claim 9 wherein the procesaLog Step 
comprises the step of detccring anomalies in said informa- 
tion. 
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11. A coiDpuicr sy^em for managiiig tbe pcucessiag of 
isfonnadoo using a ficst nctnal netwo^, tbe information 
relatiiag to tbe trsDsmissios of messages b a tclccommimi- 
citiofis Dctwoik, the system comprising: 

(0 processing rocins for monitoring the petfoitnaDoc of 
the fast neural network in pruccssii^ tb^ infonn&tiaD; 

Qi) proccsstiig means for crcatiag a second ncmal aei- 
woik of the same topology as the tot» when a prcdc- 
tcnnincd performance threshold is reached, and 

(ill) processing means £or rctrainiog the second neural 
nctwock while the infomuttiov is still being processed 
by tbe fizst neund laetAVcrlc 

12. A metbod of deriving output data from information 
about tbe transmission of messages in a conunuuications 
oetwodc, using A ^t neural ncmork, wherein tbe fit^t 
neural netwoik is implcraeated using at least One instant!- 
aied object created using an object oricnlcd programming 
language, the method compxi^n^ the steps 

(i) creating said first neural netwotk such that it bas tbe 20 
same topology as a sixond neural network: 

(ii) converting tbe object into a data structure; 

(iii) storing tbe dau stnicture; 

(iv) n?crca£ing the object from tbe dau structure; and 

(v) retraining the first neural net^wwk while conlanmng to 
derive tbe output data ^ifti'wg tbe second neural network. 

13. A method as clauDcd in claim 12 using a lirst 
processor for step (ii) and a second processor for step (iv), 
further comprising the sbq> of passing tbe data structure 
from the first processor to the second processor. 

14. The method of claim 12 wherein the object is part of 
a daughter neural oeiwoil:, and the method comprises th)& 
step of moving the daughter network lo enable it to be 
processed in p willcl with a parent neural network which is 
S9id second neural network. 



25 



30 



15. The method of daim 12 wherein the step of deriving 
the output data comprises the step of detecting anomalies in 
the inf^mation. 

16. A method of deriving output data &om in£oEmaiion 
about tbe transmission of messages in a oommunicatians 
network, the method comprising tbe steps of: 

(i) deriving the data from the inforroaiion tising a fust 
neural network, wherein the fust neural network is 
implemented using at least one instantiated object 
created using an object oriented pmgranuning lan- 
guage; 

(i) creating a second neural netwodc of tbe same topology 
as tbe first; 

(ij) relxaining the Hccood neural network while continuing 
to derive the data from the information using ^e first 
neural network; and 

(fv) using a persistence mechanism to store and retrieve 
the objecL 

17. A computer system for deriving output data from 
information about the transmissinn of messages in a com- 
mumcaiiods nctworli;. oomprising; 

(i) processor means arranged to derive the data Irom the 
information using a first neural network that is imple- 
mented using at least one instantiated object created 
using an object oriented programming langu^e; said 
processor means being further arranged lo create a 
second neural network of tbe same topology as the firsts 
find 10 retraix] tlK second neural network while con- 
dnuing to derive the data &om the information using 
the fizst neural netwodc; and 

(u) processor means arrai^ed to score and retrieve the 
object using a persistence mecbanism- 
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